# How to store @timestamp in UNIX\_MS instead of ISO date format
**URL:** https://discuss.elastic.co/t/how-to-store-timestamp-in-unix-ms-instead-of-iso-date-format/165571
**Category:** Logstash
**Created:** [January 24, 2019, 10:05am UTC](https://discuss.elastic.co/t/how-to-store-timestamp-in-unix-ms-instead-of-iso-date-format/165571 "2019-01-24T10:05:42Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Krishna\_Sunil](https://discuss.elastic.co/u/Krishna_Sunil)
#### Post date: [January 24, 2019, 10:05am UTC](https://discuss.elastic.co/t/how-to-store-timestamp-in-unix-ms-instead-of-iso-date-format/165571/1 "2019-01-24T10:05:42Z")
**Currently, @timestamp is in ISO date format. I want to store the same date in epochmilli.**
Sample code :
filter {
ruby { code =\> "event.set('epochs', ((event.get('@timestamp').to\_f\*1000).to\_i).to\_s)" }
date {
remove\_field =\> ["@timestamp"]
match =\> ["epochs","UNIX\_MS"]
target =\> "@timestamp"
}
}
**in the output, there is no @timestamp only "epochs" =\>"1548322801689" is observed**.
I also tried,
filter {
ruby { code =\> "event.set('epoch', ((event.get('@timestamp').to\_f\*1000).to\_i).to\_s)" }
grok {
remove\_field =\> ["@timestamp"]
}
date {
match =\> ["epoch","UNIX\_MS"]
target =\> "@timestamp"
}
}
**Output - @timestamp=\>"2019-01-24T09:40:01.689Z" and "epochs" =\>"1548322801689"**
Could you help ? Thank you.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 24, 2019, 1:41pm UTC](https://discuss.elastic.co/t/how-to-store-timestamp-in-unix-ms-instead-of-iso-date-format/165571/2 "2019-01-24T13:41:56Z")
> [@Krishna\_Sunil](#):
>
> date {
> remove\_field =\> ["@timestamp"]
> match =\> ["epochs","UNIX\_MS"]
> target =\> "@timestamp"
> }
"decoration", which is what we call the application of common options like remove\_field, happens _after_ the filter successfully executes. So in this case it parses epochs into @timestamp, and then removes @timestamp if there were no errors.
For the second case, a date filter creates a Logstash::TimeStamp, which is always going to look like
```
"@timestamp" => 2019-01-24T13:37:15.155Z
```
If that is not the output format you want then to not use a date filter.
---
### Author:  [@Krishna\_Sunil](https://discuss.elastic.co/u/Krishna_Sunil)
#### Post date: [February 5, 2019, 6:18pm UTC](https://discuss.elastic.co/t/how-to-store-timestamp-in-unix-ms-instead-of-iso-date-format/165571/3 "2019-02-05T18:18:46Z")
Thank you for your reply.
Could you suggest a way for getting @timestamp in epochmilli.
Currently, the output is in ISO format **"@timestamp": " 2019-01-24T09:40:01.689Z"** want it like this **"@timestamp" : " 1548322801689"**
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 5, 2019, 6:29pm UTC](https://discuss.elastic.co/t/how-to-store-timestamp-in-unix-ms-instead-of-iso-date-format/165571/4 "2019-02-05T18:29:56Z")
I do not think that is possible. If you do something like
```
ruby { code => "event.set('epoch', ((event.get('@timestamp').to_f*1000).to_i).to_s)" }
mutate { remove_field => ["@timestamp"] }
mutate { rename => { "epoch" => "@timestamp" } }
```
It will raise an exception, because the [code](https://github.com/elastic/logstash/blob/e262d6b0b60befac430a3ebbf195648103704b9d/logstash-core/src/main/java/org/logstash/ext/JrubyEventExtLibrary.java#L93) expects @timestamp to be a LogStash::Timestamp. You have to use a different field name.
---
### Author:  [@Krishna\_Sunil](https://discuss.elastic.co/u/Krishna_Sunil)
#### Post date: [February 6, 2019, 8:33pm UTC](https://discuss.elastic.co/t/how-to-store-timestamp-in-unix-ms-instead-of-iso-date-format/165571/5 "2019-02-06T20:33:33Z")
Sure, Thank you.
Cheers!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 6, 2019, 8:33pm UTC](https://discuss.elastic.co/t/how-to-store-timestamp-in-unix-ms-instead-of-iso-date-format/165571/6 "2019-03-06T20:33:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.