# How to index nanoseconds precision events with Logstash (7.10) and type date\_nanos

**URL:** https://discuss.elastic.co/t/how-to-index-nanoseconds-precision-events-with-logstash-7-10-and-type-date-nanos/262029
**Category:** Logstash
**Created:** [January 24, 2021, 11:14am UTC](https://discuss.elastic.co/t/how-to-index-nanoseconds-precision-events-with-logstash-7-10-and-type-date-nanos/262029 "2021-01-24T11:14:24Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![juan.domenech](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan.domenech/32/142257_2.png) [@juan.domenech](https://discuss.elastic.co/u/juan.domenech)
#### Post date: [January 24, 2021, 11:14am UTC](https://discuss.elastic.co/t/how-to-index-nanoseconds-precision-events-with-logstash-7-10-and-type-date-nanos/262029/1 "2021-01-24T11:14:24Z")

</div>

**Problem statement**

- Elasticsearch 7.10 supports timestamp with nanoseconds precision (type **date\_nanos** )
- Kibana 7.10 [visualises these timestamps](https://xeraa.net/blog/2019_date-nano-elasticsearch-kibana/)
- but Logstash [can't handle them yet](https://github.com/elastic/logstash/issues/10822) (precision above milliseconds is lost when applied to field @timestamp)

**Workaround**  
I'll share here how I've managed to do it but I'm happy to hear better options.

**Step #1 Convert your nanoseconds timestamp from number to date**  
(ignore this step if you already have your timestamp in this format)  
Logstash filter date does not support nanoseconds Epoch **UNIX\_NS** conversion yet so we do the conversion using Ruby code.

```auto
  # Example date "2009-02-13T23:31:30.123456789Z"
  mutate { add_field => { "@timestamp_source" => "1234567890123456789" } }
  ruby {
    code => "
        event.set('[@timestamp_nanoseconds]', (Time.at( (event.get('[@timestamp_source]')[0...10]).to_i ).to_datetime).strftime('%Y-%m-%dT%H:%M:%S.') + event.get('[@timestamp_source]')[-9..-1] +'Z' )
        event.set('[@timestamp]', LogStash::Timestamp.new(event.get('[@timestamp_nanoseconds]')) )
      "
  }

```

We get @timestamp\_nanoseconds in date string format and native @timestamp in milliseconds.  
Output:

```auto
{
         "@timestamp_source" => "1234567890123456789",
                   "message" => "",
    "@timestamp_nanoseconds" => "2009-02-13T23:31:30.123456789Z",
                "@timestamp" => 2009-02-13T23:31:30.123Z,
                      "host" => "local",
                  "@version" => "1"
}

```

**Step #2 Add to your index template date\_nanos format for field @timestamp\_nanoseconds**

```auto
{
  "mappings": {
    "properties": {
      "@timestamp": { "type": "date" },
      "@timestamp_nanoseconds": { "type": "date_nanos" }
    }
  }
}

```

**Step #3 Index data and create Kibana Index Template selecting @timestamp\_nanoseconds as Time Field**

 ![date_nanos_post_index_patterns_2](https://us1.discourse-cdn.com/elastic/original/3X/5/5/55cd9b0d7ed5394d0dbe5de6a3a251cc7214113b.png)

The new precision becomes available on Kibana:

 ![date_nanos_post_kibana](https://us1.discourse-cdn.com/elastic/original/3X/9/c/9ccaa2864eafce07dbc4682708de3a9612140bce.png)

I hope it helps.  
Thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 21, 2021, 11:14am UTC](https://discuss.elastic.co/t/how-to-index-nanoseconds-precision-events-with-logstash-7-10-and-type-date-nanos/262029/2 "2021-02-21T11:14:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.