# Merge indices with timestamp in epoch

**URL:** <https://discuss.elastic.co/t/merge-indices-with-timestamp-in-epoch/114276>\
**Category:** Logstash\
**Created:** [January 5, 2018, 11:08am UTC](https://discuss.elastic.co/t/merge-indices-with-timestamp-in-epoch/114276 "2018-01-05T11:08:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![oskars](https://avatars.discourse-cdn.com/v4/letter/o/ecb155/32.png) [@oskars](https://discuss.elastic.co/u/oskars)\
**Post date:** [January 5, 2018, 11:08am UTC](https://discuss.elastic.co/t/merge-indices-with-timestamp-in-epoch/114276/1 "2018-01-05T11:08:14Z")

</div>

Im having problems merging indices with "@timestamp" field with epoch time.

so i got indice (es.2.4) :

```
{
  "_source": {
    "@timestamp": "1514851163146",
     . . .
  }
}

```

im using logstash (tested with 2.4v and latest version) my `logstash.conf` looks like :

```
input {
  elasticsearch {
    . . .
  } 
}
filter {
  date {
    match => ["@timestamp", "UNIX_MS"]
  }
}
output {
  elasticsearch {
    . . .
  } 
}

```

Error im getting is : `WARN org.logstash.Event - Error parsing @timestamp string value=`  
Logstash adds tag: `[0] "_timestampparsefailure"` and field `"_@timestamp" => "1512125189650"`

I understand one workaround is to trim (or insert [10]"."[3]) timestamp field from 13 chars to 10 and try to use "match =\> ["@timestamp", "UNIX"]" but im unable to capture "@timestamp" field before logstash parse error. I tried :

```
filter {
  ruby {
    code => "event.set('timestamp_new1', event.get('@timestamp'))"
  }
  mutate {
    add_field => {"timestamp_new2" => "%{@timestamp}"}
  }
}

```

Thanks in advance !  
//Oskars

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 2, 2018, 11:08am UTC](https://discuss.elastic.co/t/merge-indices-with-timestamp-in-epoch/114276/2 "2018-02-02T11:08:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.