# Filebeat timestamp processor to parse from epoch/unix\_ms to readable format **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [April 11, 2023, 7:15am UTC](https://discuss.elastic.co/t/filebeat-timestamp-processor-to-parse-from-epoch-unix-ms-to-readable-format/329712 "2023-04-11T07:15:17Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![rkelastic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rkelastic/32/119663_2.png) [@rkelastic](https://discuss.elastic.co/u/rkelastic)\ **Post date:** [April 11, 2023, 7:15am UTC](https://discuss.elastic.co/t/filebeat-timestamp-processor-to-parse-from-epoch-unix-ms-to-readable-format/329712/1 "2023-04-11T07:15:17Z")
I want to convert an epoch timestamp (ex: 1680940932415) to readable format (ex: '2006-01-02 15:04:05') using timestamp processor ([Timestamp | Filebeat Reference [8.7] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/processor-timestamp.html)), but am unable to achieve it. ```auto processors: - decode_json_fields: fields: ["message"] target: "" overwrite_keys: true - timestamp: field: "timestamp" target_field: "newtp" layouts: - '2006-01-02T15:04:05Z' - '2006-01-02T15:04:05.999Z' - '2006-01-02T15:04:05.999-07:00' test: - "1680940932415" ``` Is this even doable using the timestamp processor? thanks in advance ---
**Author:** ![FrankieCaldwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frankiecaldwell/32/119664_2.png) [@FrankieCaldwell](https://discuss.elastic.co/u/FrankieCaldwell)\ **Post date:** [April 11, 2023, 7:21am UTC](https://discuss.elastic.co/t/filebeat-timestamp-processor-to-parse-from-epoch-unix-ms-to-readable-format/329712/2 "2023-04-11T07:21:55Z")
In order to convert the epoch timestamp (e.g. 1680940932415) to date and time format (e.g. '2006-01-02 15:04:05'), you need to make a few changes to your configuration file: Make sure that you specify the correct field name containing the timestamp. In your case, it is the "timestamp" field. Specify the correct format for the timestamp you want to convert. For your timestamp, the format must be "unix\_ms". Specify the desired date and time output format with the "layout" parameter. In your case it should be '2006-01-02 15:04:05'. processors: - decode\_json\_fields: fields: ["message"] target: "" overwrite\_keys: true - timestamp: field: "timestamp" target\_field: "newtp" test: - "1680940932415" layouts: - "2006-01-02 15:04:05" timezone: "UTC" locale: "en" # format: unix\_ms Note that I have added the "timezone" and "locale" parameters to set the timezone and locale to convert the date and time. You can change them according to your requirements ---
**Author:** ![rkelastic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rkelastic/32/119663_2.png) [@rkelastic](https://discuss.elastic.co/u/rkelastic)\ **Post date:** [April 11, 2023, 7:47am UTC](https://discuss.elastic.co/t/filebeat-timestamp-processor-to-parse-from-epoch-unix-ms-to-readable-format/329712/3 "2023-04-11T07:47:30Z")
Thanks for replying, but this didnt solve my problem. I am still getting the error that the test timestamp cannot be parsed ```auto Exiting: error initializing processors: failed to parse test timestamp: failed parsing time field timestamp='1680940932415' ``` ---
**Author:** ![FrankieCaldwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frankiecaldwell/32/119664_2.png) [@FrankieCaldwell](https://discuss.elastic.co/u/FrankieCaldwell)\ **Post date:** [April 11, 2023, 8:07am UTC](https://discuss.elastic.co/t/filebeat-timestamp-processor-to-parse-from-epoch-unix-ms-to-readable-format/329712/4 "2023-04-11T08:07:13Z")
> [@rkelastic](#): > > `Exiting: error initializing processors: failed to parse test timestamp: failed parsing time field timestamp='1680940932415'` I apologize for the confusion in the previous response. To solve this problem, you can use the Go time package to convert the epoch timestamp to a valid timestamp format that can be analyzed by the timestamp processor. Here is an example of how to do this in Go: package main import ( "fmt" "time" ) func main() { epochTime := int64(1680940932415) convertedTime := time.Unix(epochTime/1000, (epochTime%1000)\*int64(time.Millisecond)) ``` fmt.Println(convertedTime.Format("2006-01-02T15:04:05.000Z07:00")) ``` } In this example, we first convert the epoch timestamp to a Unix timestamp by dividing it by 1000 and getting the remainder using the module operator. Then we create a time object using the Unix function and pass the converted Unix timestamp and the remaining milliseconds. Finally, we format the converted time using the format string "2006-01-02T15:04:05.000Z07:00", which is a valid format that can be analyzed by the timestamp processor. ---
**Author:** ![rkelastic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rkelastic/32/119663_2.png) [@rkelastic](https://discuss.elastic.co/u/rkelastic)\ **Post date:** [April 12, 2023, 11:37am UTC](https://discuss.elastic.co/t/filebeat-timestamp-processor-to-parse-from-epoch-unix-ms-to-readable-format/329712/5 "2023-04-12T11:37:45Z")
thanks for the reply, i looked at various reponses on similar queries, but couldnt make them work. so i decided to do this filtering in ingest pipeline of Elasticsearch Here's the pipeline that i used to convert epoch data to date time field in Elasticsearch ```auto { "epoch-to-date-pipeline": { "description": "test pipeline to parse timestamp field", "processors": [ { "date": { "field": "timestamp", "formats": [ "UNIX_MS" ], "if": "ctx.timestamp != null && (ctx.timestamp instanceof String || ctx.timestamp instanceof Number)" } } ] } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 10, 2023, 1:38pm UTC](https://discuss.elastic.co/t/filebeat-timestamp-processor-to-parse-from-epoch-unix-ms-to-readable-format/329712/6 "2023-05-10T13:38:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.