I have a field that is datetime in long value: "action_date":636346116012468640
So i want to use date filter to convert it to Unix date time:
date {
match => [ "action_date", "what is date format?" ]
}
What does this value represent? Nanoseconds since some point in time...? Where does it come from?
It's nanoseconds value: see from: DateTime.Ticks Property (System) | Microsoft Learn
The value of this property represents the number of 100-nanosecond intervals that have elapsed since 12:00:00 midnight, January 1, 0001 (0:00:00 UTC on January 1, 0001, in the Gregorian calendar), which represents DateTime.MinValue. It does not include the number of ticks that are attributable to leap seconds.
Okay. I don't think the date filter supports converting from such timestamps.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.