# Field conversion - Transforming Unix Time into Date

**URL:** <https://discuss.elastic.co/t/field-conversion-transforming-unix-time-into-date/320063>\
**Category:** Kibana\
**Created:** [November 29, 2022, 3:17pm UTC](https://discuss.elastic.co/t/field-conversion-transforming-unix-time-into-date/320063 "2022-11-29T15:17:19Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![pedrodantas](https://avatars.discourse-cdn.com/v4/letter/p/a183cd/32.png) [@pedrodantas](https://discuss.elastic.co/u/pedrodantas)\
**Post date:** [November 29, 2022, 3:17pm UTC](https://discuss.elastic.co/t/field-conversion-transforming-unix-time-into-date/320063/1 "2022-11-29T15:17:19Z")

</div>

Hello!

I was wondering if there is a way to convert a field that is being received in Unix Time (long) into a fully readable Date in the Kibana environment.

My application is sending JSON logs to Kibana. Two of the log fields are numbers representing a UnixTimeStamp. In this case, the begin and end dates of a procedure.

```auto
{
  beginDate: 1669734768,
  endDate: 1669734780
}

```

This means that when I try to access these fields in a Table Visualization, the data is represented as it shows.  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/f/af598a7d04711300588c25ce8eb79d19a1bc1331.png)

Is there a way to parse this UnixTimeStamp into a more user-friendy date model so that it is easier to read in the Visualization?  
Something like "May 25th 2016, 22:39:30.000" or similar.

Thank you!

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [November 29, 2022, 4:38pm UTC](https://discuss.elastic.co/t/field-conversion-transforming-unix-time-into-date/320063/2 "2022-11-29T16:38:03Z")

</div>

Few ways to do this but I'd suggest having your ingestion pipeline with the data use a [Date Processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/date-processor.html) on its way into Elastic. It will take that value and create a new field that is formatted and mapped properly.

**Example**

```auto
POST /_ingest/pipeline/_simulate
{
  "docs": [
    {
      "_index": "index",
      "_id": "id",
      "_source": {
        "beginDate": 1669734768
      }
    }
  ],
  "pipeline": {
    "processors": [
      {
        "date": {
          "field": "beginDate",
          "formats": [
            "UNIX"
          ],
          "target_field": "beginDateFormatted"
        }
      }
    ]
  }
}

```

---

<div class="post-metadata">

**Author:** ![pedrodantas](https://avatars.discourse-cdn.com/v4/letter/p/a183cd/32.png) [@pedrodantas](https://discuss.elastic.co/u/pedrodantas)\
**Post date:** [November 29, 2022, 5:36pm UTC](https://discuss.elastic.co/t/field-conversion-transforming-unix-time-into-date/320063/3 "2022-11-29T17:36:14Z")

</div>

Alright! I've tried something similar to your approach, creating a variable called "epoch" that maps the UnixTimeStamp to Date.

```auto
mutate {
  add_field => {"epoch" => "[@metadata][rabbitmq_properties][timestamp]"}
}
date {
  match => ["[message][beginDate]","UNIX" ]
  target => "epoch"
}

```

The field is parsed correctly as can be seen in the log that was received here.

 ![kibana-problem-2](https://us1.discourse-cdn.com/elastic/original/3X/3/a/3a05df88c2b09c479aa42e4334499d6ee48462c9.png)

However, when the field is fetched in the Kibana Visualization it appears as a number.

![kibana-problem-3](https://us1.discourse-cdn.com/elastic/original/3X/7/5/754aba4a62afd925f9cb95d35298546706598e59.png)

Do you have any idea why this is happening?

Thanks again!

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [November 29, 2022, 5:53pm UTC](https://discuss.elastic.co/t/field-conversion-transforming-unix-time-into-date/320063/4 "2022-11-29T17:53:38Z")

</div>

What is your elastic data mapping for the field `epoch`? I don't think it's correct. Should be a date type.

---

<div class="post-metadata">

**Author:** ![pedrodantas](https://avatars.discourse-cdn.com/v4/letter/p/a183cd/32.png) [@pedrodantas](https://discuss.elastic.co/u/pedrodantas)\
**Post date:** [November 30, 2022, 3:20pm UTC](https://discuss.elastic.co/t/field-conversion-transforming-unix-time-into-date/320063/5 "2022-11-30T15:20:58Z")

</div>

Yup, it is working now! Thank you for your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 28, 2022, 3:21pm UTC](https://discuss.elastic.co/t/field-conversion-transforming-unix-time-into-date/320063/6 "2022-12-28T15:21:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.