# @timestamp to unix epoch conversion in Logstash 7.0.1

**URL:** https://discuss.elastic.co/t/timestamp-to-unix-epoch-conversion-in-logstash-7-0-1/181142
**Category:** Logstash
**Created:** [May 15, 2019, 10:03am UTC](https://discuss.elastic.co/t/timestamp-to-unix-epoch-conversion-in-logstash-7-0-1/181142 "2019-05-15T10:03:51Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)
#### Post date: [May 15, 2019, 10:03am UTC](https://discuss.elastic.co/t/timestamp-to-unix-epoch-conversion-in-logstash-7-0-1/181142/1 "2019-05-15T10:03:51Z")

</div>

Hello!  
I am attempting to convert @timestamp to unix epoch.  
When running in a online parser:  
[https://repl.it/repls/FlatPristineEmulation](https://repl.it/repls/FlatPristineEmulation) it does what it supposed to do.

![ruby_compile](https://us1.discourse-cdn.com/elastic/original/3X/1/1/114e16f25c358a402eb62d55671412536d9729dd.png)

**My test configuration:**  
input {stdin { }}

```
filter {
 grok { match => ["message", "%{GREEDYDATA:test_data}$"]}
 mutate{ add_field => ["timestamp_unix","%{test_data}"] }
 ruby { code => "require 'date';event['epoch'] = DateTime.parse(event['timestamp_unix']).strftime('%s')" }
 mutate{ remove_field => ["timestamp_unix"] }
}

output {stdout { codec => rubydebug }}

```

**Test stdin:**  
2019-05-15T09:56:11.791Z

**Debug output:**

```
[DEBUG] 2019-05-15 12:01:11.341 [[main]>worker2] grok - Running grok filter {:event=>#<LogStash::Event:0x3483697>}
[DEBUG] 2019-05-15 12:01:11.350 [[main]>worker2] grok - Event now: {:event=>#<LogStash::Event:0x3483697>}
[DEBUG] 2019-05-15 12:01:11.359 [[main]>worker2] decorators - filters/LogStash::Filters::Mutate: adding value to field {"field"=>"timestamp_unix", "value"=>["%{test_data}"]}
[ERROR] 2019-05-15 12:01:11.362 [[main]>worker2] ruby - Ruby exception occurred: undefined method `[]' for #<LogStash::Event:0x3483697>
[DEBUG] 2019-05-15 12:01:11.365 [[main]>worker2] mutate - filters/LogStash::Filters::Mutate: removing field {:field=>"timestamp_unix"}
{
       "message" => "2019-05-15T09:56:11.791Z",
     "test_data" => "2019-05-15T09:56:11.791Z",
          "tags" => [
        [0] "_rubyexception"
    ],
    "@timestamp" => 2019-05-15T10:01:11.236Z,
          "host" => "localhost",
      "@version" => "1"
}

```

Looks like I cannot access to the field somehow.  
How it should be done in newest Logstash 7.0.1 release?

---

<div class="post-metadata">

### Author: ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)
#### Post date: [May 15, 2019, 11:00am UTC](https://discuss.elastic.co/t/timestamp-to-unix-epoch-conversion-in-logstash-7-0-1/181142/2 "2019-05-15T11:00:32Z")

</div>

The way you access event fields inside Ruby blocks has [changed](https://www.elastic.co/guide/en/logstash/current/event-api.html) in the recent Logstash versions.

Try this

```auto
filter {
 grok { match => ["message", "%{GREEDYDATA:test_data}$"]}
 mutate{ add_field => ["timestamp_unix","%{test_data}"] }
 ruby { 
     init => "require 'date'"
     code => "event.set('epoch', DateTime.parse(event.get('timestamp_unix')).strftime('%s'))" 
 }
 mutate{ remove_field => ["timestamp_unix"] }
}

output {stdout { codec => rubydebug }}
```

---

<div class="post-metadata">

### Author: ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)
#### Post date: [May 15, 2019, 12:34pm UTC](https://discuss.elastic.co/t/timestamp-to-unix-epoch-conversion-in-logstash-7-0-1/181142/3 "2019-05-15T12:34:09Z")

</div>

> [@pastechecker](#):
>
> 2019-05-15T09:56:11.791Z

Seems to throw error:

```
[DEBUG] 2019-05-15 14:33:24.669 [Converge PipelineAction::Create<main>] javapipeline - Starting pipeline {:pipeline_id=>"main"}
warning: thread "[main]-pipeline-manager" terminated with exception (report_on_exception is true):
SyntaxError: (ruby filter code):3: syntax error, unexpected keyword_end

                     eval at org/jruby/RubyKernel.java:1061
                 register at /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.5/lib/logstash/filters/ruby.rb:59
                 register at org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:56
         register_plugins at /usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:191
                     each at org/jruby/RubyArray.java:1792
         register_plugins at /usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:190
  maybe_setup_out_plugins at /usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:446
            start_workers at /usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:203
                      run at /usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:145
                    start at /usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:104
[ERROR] 2019-05-15 14:33:24.774 [Converge PipelineAction::Create<main>] agent - Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}
[TRACE] 2019-05-15 14:33:24.786 [Ruby-0-Thread-1: /usr/share/logstash/lib/bootstrap/environment.rb:6] agent - Converge results {:success=>false, :failed_actions=>["id: main, action_type: LogStash::PipelineAction::Create, message: Could not execute action: PipelineAction::Create<main>, action_result: false"], :successful_actions=>[]}

```

---

<div class="post-metadata">

### Author: ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)
#### Post date: [May 15, 2019, 12:49pm UTC](https://discuss.elastic.co/t/timestamp-to-unix-epoch-conversion-in-logstash-7-0-1/181142/4 "2019-05-15T12:49:25Z")

</div>

Oh right, I missed a parenthesis on the above code. Fixed it.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 15, 2019, 12:51pm UTC](https://discuss.elastic.co/t/timestamp-to-unix-epoch-conversion-in-logstash-7-0-1/181142/5 "2019-05-15T12:51:35Z")

</div>

Wouldn't it be simpler to use to\_f or to\_i?

```
ruby { code => 'event.set( "epoch", event.get("@timestamp").to_f)' }
```

---

<div class="post-metadata">

### Author: ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)
#### Post date: [May 15, 2019, 1:05pm UTC](https://discuss.elastic.co/t/timestamp-to-unix-epoch-conversion-in-logstash-7-0-1/181142/6 "2019-05-15T13:05:51Z")

</div>

> [@Badger](#):
>
> ruby { code =\> 'event.set( "epoch", event.get("@timestamp").to\_f)' }

Thanks Badger.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 12, 2019, 1:05pm UTC](https://discuss.elastic.co/t/timestamp-to-unix-epoch-conversion-in-logstash-7-0-1/181142/7 "2019-06-12T13:05:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.