Hi Magnus,
I've applied this filter
filter {
mutate {
remove_field => [ "host", "tags", "count", "source" ]
}
mutate {
gsub => ["EdgeStartTimestamp", "\d{6}$", ""]
}
date {
match => [ "EdgeStartTimestamp", "UNIX_MS" ]
target => "EdgeStartTime"
}
}
but the result was not what I expected:
|t EdgeStartTime| |48638255-11-25T05:53:19.872Z|
|# EdgeStartTimestamp| |1,534,812,939,553,999,872|
this is the json view on kibana:
"EdgeStartTimestamp": 1534812939554000000,
"ClientRequestMethod": "POST",
"EdgeEndTimestamp": 1534812939700000000,
"input_type": "log",
"WAFRuleID": "",
"EdgeStartTime": "48638255-11-25T05:53:19.872Z"
Where is my mistake?
Thanks.