# Howto convert UNIX timestamp json field into ISO8601 format
**URL:** https://discuss.elastic.co/t/howto-convert-unix-timestamp-json-field-into-iso8601-format/145109
**Category:** Logstash
**Created:** [August 20, 2018, 7:57am UTC](https://discuss.elastic.co/t/howto-convert-unix-timestamp-json-field-into-iso8601-format/145109 "2018-08-20T07:57:05Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Roberto\_Giordani](https://discuss.elastic.co/u/Roberto_Giordani)
#### Post date: [August 20, 2018, 7:57am UTC](https://discuss.elastic.co/t/howto-convert-unix-timestamp-json-field-into-iso8601-format/145109/1 "2018-08-20T07:57:06Z")
Hi,
I've allowed filebeat to parse a json log, but the Unix timestamp fields like this
"EdgeStartTimestamp": 1534732311104000000,
on Kibana is converted in this way
EdgeStartTimestamp 1,534,732,311,104,000,000.
instead of ISO8601.
Could someone help me to convert it in ISO8601 format?
thanks
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 20, 2018, 12:48pm UTC](https://discuss.elastic.co/t/howto-convert-unix-timestamp-json-field-into-iso8601-format/145109/2 "2018-08-20T12:48:22Z")
Use a mutate filter to remove the last three digits from the number to turn the microseconds into milliseconds (use the gsub option), then feed the result to a date filter. Use the UNIX\_MS date pattern.
---
### Author:  [@Roberto\_Giordani](https://discuss.elastic.co/u/Roberto_Giordani)
#### Post date: [August 21, 2018, 6:07am UTC](https://discuss.elastic.co/t/howto-convert-unix-timestamp-json-field-into-iso8601-format/145109/3 "2018-08-21T06:07:19Z")
Hi Magnus,
I've applied this filter
filter {
mutate {
remove\_field =\> ["host", "tags", "count", "source"]
}
mutate {
gsub =\> ["EdgeStartTimestamp", "\d{6}$", ""]
}
date {
match =\> ["EdgeStartTimestamp", "UNIX\_MS"]
target =\> "EdgeStartTime"
}
}
but the result was not what I expected:
|t EdgeStartTime| |48638255-11-25T05:53:19.872Z|
|# EdgeStartTimestamp| |1,534,812,939,553,999,872|
this is the json view on kibana:
**"EdgeStartTimestamp": 1534812939554000000** ,
"ClientRequestMethod": "POST",
"EdgeEndTimestamp": 1534812939700000000,
"input\_type": "log",
"WAFRuleID": "",
**"EdgeStartTime": "48638255-11-25T05:53:19.872Z"**
Where is my mistake?
Thanks.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 21, 2018, 7:06am UTC](https://discuss.elastic.co/t/howto-convert-unix-timestamp-json-field-into-iso8601-format/145109/4 "2018-08-21T07:06:24Z")
It appears the gsub didn't work. Perhaps you need to convert the field into a string first?
Also, when you're removing the last _six_ digits you're down to seconds so UNIX is the correct date pattern.
---
### Author:  [@Roberto\_Giordani](https://discuss.elastic.co/u/Roberto_Giordani)
#### Post date: [August 21, 2018, 8:10am UTC](https://discuss.elastic.co/t/howto-convert-unix-timestamp-json-field-into-iso8601-format/145109/5 "2018-08-21T08:10:28Z")
Yes, this is the trick.
The timestamp is in milliseconds so I've to use UNIX\_MS
```
mutate {
convert => { "EdgeStartTimestamp" => "string" }
convert => { "EdgeEndTimestamp" => "string" }
}
mutate {
gsub => ["EdgeStartTimestamp", "\d{6}$", ""]
gsub => ["EdgeEndTimestamp", "\d{6}$", ""]
}
mutate {
convert => { "EdgeStartTimestamp" => "integer" }
convert => { "EdgeEndTimestamp" => "integer" }
}
date {
match => ["EdgeStartTimestamp", "UNIX_MS"]
target => "EdgeStartTime"
remove_field => ["EdgeStartTimestamp"]
}
date {
match => ["EdgeEndTimestamp", "UNIX_MS"]
target => "EdgeEndTime"
remove_field => ["EdgeEndTimestamp"]
}
```
Can be optimized this flow?
Thank you for your input.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 21, 2018, 8:47am UTC](https://discuss.elastic.co/t/howto-convert-unix-timestamp-json-field-into-iso8601-format/145109/6 "2018-08-21T08:47:21Z")
The second conversion back to integer serves no purpose. Otherwise this is probably as good as it gets.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 18, 2018, 8:47am UTC](https://discuss.elastic.co/t/howto-convert-unix-timestamp-json-field-into-iso8601-format/145109/7 "2018-09-18T08:47:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.