@timestamp - Epoch - Illegal Date Format exception

[SKumarMN (SK)]

Hi All,

ES index is having a field with the mapping as below.

"@timestamp": {
"format": "epoch_millis",
"type": "date"
}

From logstash i want to populate this field with custom timestamp obtained from input document. The custom time stamp is in millis and i have used the filter

date{
match => ["time_mills","UNIX_MS"]
target =>"@timestamp"
}

however during indexing it fails complaining the time format issue. Can you please help

[magnusbaeck (Magnus Bäck)]

The date filter always produces an ISO8601 timestamp that can't be stored in your @timestamp field.

If you already have the time in milliseconds in the time_millis field, why would you need a date filter? Just copy the field value to the @timestamp field.

[SKumarMN (SK)]

I had tried the below but got the same issues hence went with date filter

filter {
mutate {
copy => { "time_millis" => "@timestamp" }
}
}