Parse UNIX timestamp as human readable date while moving the data into elasticsearch

Elastic Stack Logstash
2

You can only convert to types that exist in JSON (this only affects how the JSON documents being sent to Elasticsearch are formatted, not how Elasticsearch interprets and indexes these).

Your current date filter populates the @timestamp field. If you also want to store the other fields as dates I would probably do something like this (not tested):

date{
    match => ["lastUpdated", "UNIX_MS"]
    target => "lastUpdated"
}

date{
    match => ["firstUpdated", "UNIX_MS"]
    target => "firstUpdated"
}
1 Like