Format time field after xml plugin

I have the xml plugin running successfully on my data and can see our log files split out nicely in Kibana. What I need to do is convert a time field from this format:
Which I think is saying milliseconds, but I want to to be shown as seconds.
This field is produced by the XML plugin - so it is called "xml_content.Duration" - would it be accessible to logstash at this point? I tried to put a date filter after the xml filter but didn't see any difference.

Or is there a better place to do this conversion - Kibana scripted field maybe?
We want to graph the duration as a dashboard because long durations would indicate trouble in the system!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.