# Unable to convert timestamp to Date field

**URL:** <https://discuss.elastic.co/t/unable-to-convert-timestamp-to-date-field/120098>\
**Category:** Logstash\
**Created:** [February 16, 2018, 4:25am UTC](https://discuss.elastic.co/t/unable-to-convert-timestamp-to-date-field/120098 "2018-02-16T04:25:34Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![Karanushah.1992](https://avatars.discourse-cdn.com/v4/letter/k/e79b87/32.png) [@Karanushah.1992](https://discuss.elastic.co/u/Karanushah.1992)\
**Post date:** [February 16, 2018, 4:25am UTC](https://discuss.elastic.co/t/unable-to-convert-timestamp-to-date-field/120098/1 "2018-02-16T04:25:34Z")

</div>

I am trying to convert a string field called timestamp with value 1510722000000 in date format field in Logstash. My sole purpose is to visualize data in kibana using this date field. I tried using the date filter but it does not create the target field for me. Can anyone tell me How can I achieve this

My date filter looks like this  
date {  
timezone =\> "UTC"  
match =\> ["timestamp", "UNIX\_MS"]  
target =\> "@timestamp1"  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 16, 2018, 7:26am UTC](https://discuss.elastic.co/t/unable-to-convert-timestamp-to-date-field/120098/2 "2018-02-16T07:26:11Z")

</div>

This looks okay. Please show

- your full configuration,
- an example input message,
- the output from a `stdout { codec => rubydebug }` output plugin.

---

<div class="post-metadata">

**Author:** ![Karanushah.1992](https://avatars.discourse-cdn.com/v4/letter/k/e79b87/32.png) [@Karanushah.1992](https://discuss.elastic.co/u/Karanushah.1992)\
**Post date:** [February 16, 2018, 4:11pm UTC](https://discuss.elastic.co/t/unable-to-convert-timestamp-to-date-field/120098/3 "2018-02-16T16:11:26Z")

</div>

```
      "tags" => [
    [0] "multiline",
    [1] "_dateparsefailure"
],
      "path" => "C:\\Users\\186\\Downloads\\xml_dev\\27.xml",
"@timestamp" => 2018-02-16T16:08:33.969Z,
```

---

<div class="post-metadata">

**Author:** ![Karanushah.1992](https://avatars.discourse-cdn.com/v4/letter/k/e79b87/32.png) [@Karanushah.1992](https://discuss.elastic.co/u/Karanushah.1992)\
**Post date:** [February 16, 2018, 4:12pm UTC](https://discuss.elastic.co/t/unable-to-convert-timestamp-to-date-field/120098/4 "2018-02-16T16:12:30Z")

</div>

my Configuration file

input {  
file {  
path =\> "C:\Users\186181152\Downloads\xml\_dev\27.xml"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
codec =\> multiline {  
pattern =\> "measurement.$"  
what =\> "previous"  
}

}  
}

filter  
{  
xml  
{  
source =\> "message"  
target =\> "doc"  
store\_xml =\> false  
xpath =\> ["//measure/@measure","bt\_name"]  
xpath =\> ["//measure/@aggregation","aggregation\_type"]  
xpath =\> ["//measurement/@count","count"]  
xpath =\> ["//measurement/@timestamp","timestamp"]  
xpath =\> ["//measurement/@min","min"]  
xpath =\> ["//measurement/@sum","sum"]  
}  
date {  
timezone =\> "UTC"  
match =\> ["timestamp", "UNIX\_MS"]  
target =\> "@timestamp1"  
}  
if "Count" in [aggregation\_type]  
{  
mutate {add\_field =\> {"aggr\_count" =\> "%{aggregation\_type}"}}  
}  
else if "95th Percentile" in [aggregation\_type] {  
mutate {add\_field =\> {"aggr\_95" =\> "%{aggregation\_type}"}}  
}

```
mutate 
{
convert => {"count" => "integer"
			"min" => "integer"
			"max" => "integer"
			"sum" => "integer"
}
remove_field => ["aggregation_type"]	
}

```

}

output  
{  
elasticsearch  
{  
action =\> "index"  
index =\> "bt2"  
hosts =\> "localhost:9200"  
workers =\> 1  
}  
stdout  
{  
codec =\> rubydebug  
}  
}

---

<div class="post-metadata">

**Author:** ![Karanushah.1992](https://avatars.discourse-cdn.com/v4/letter/k/e79b87/32.png) [@Karanushah.1992](https://discuss.elastic.co/u/Karanushah.1992)\
**Post date:** [February 16, 2018, 4:22pm UTC](https://discuss.elastic.co/t/unable-to-convert-timestamp-to-date-field/120098/5 "2018-02-16T16:22:43Z")

</div>

My Sample input  
\< measurement timestamp="1510722000000" blah blah\>

---

<div class="post-metadata">

**Author:** ![Karanushah.1992](https://avatars.discourse-cdn.com/v4/letter/k/e79b87/32.png) [@Karanushah.1992](https://discuss.elastic.co/u/Karanushah.1992)\
**Post date:** [February 16, 2018, 6:56pm UTC](https://discuss.elastic.co/t/unable-to-convert-timestamp-to-date-field/120098/6 "2018-02-16T18:56:38Z")

</div>

Hi @magnusbaeck

The input value in timestamp is 1510722000000 . When I convert this to human readable format using online tools I get 11/16/49842 @ 8:00am (UTC) . Can this be the reason for parse failure ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 16, 2018, 8:30pm UTC](https://discuss.elastic.co/t/unable-to-convert-timestamp-to-date-field/120098/7 "2018-02-16T20:30:11Z")

</div>

Please show the whole message, not just the `tags`, `path`, and `@timestamp` fields.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 16, 2018, 8:30pm UTC](https://discuss.elastic.co/t/unable-to-convert-timestamp-to-date-field/120098/8 "2018-02-16T20:30:56Z")

</div>

> The input value in timestamp is 1510722000000 . When I convert this to human readable format using online tools I get 11/16/49842 @ 8:00am (UTC) . Can this be the reason for parse failure ?

Perhaps those online tools assume it seconds from the epoch when your timestamp is actually milliseconds from the epoch.

---

<div class="post-metadata">

**Author:** ![Karanushah.1992](https://avatars.discourse-cdn.com/v4/letter/k/e79b87/32.png) [@Karanushah.1992](https://discuss.elastic.co/u/Karanushah.1992)\
**Post date:** [February 20, 2018, 6:11pm UTC](https://discuss.elastic.co/t/unable-to-convert-timestamp-to-date-field/120098/9 "2018-02-20T18:11:50Z")

</div>

@magnusbaeck Hi, Hope this helps

```
      "tags" => [
    [0] "multiline",
    [1] "_dateparsefailure"
],
      "path" => "C:\\Users\\186\\Downloads\\xml_dev\\27.xml",
"@timestamp" => 2018-02-20T18:04:05.641Z,
       "avg" => [
    [0] "5262.85302734375",
    [1] "4866.47314453125",
    [2] "5032.392822265625",
    [3] "4062.9139404296875",
    [4] "4947.111328125",
    [5] "4758.715087890625",
    [6] "3081.375244140625",
    [7] "4437.6788330078125",
    [8] "7593.035888671875",
    [9] "15168.4794921875",
    [10] "4901.086669921875",
    [11] "4973.13232421875",
    [12] "5004.08642578125",
    [13] "4736.31689453125",
    [14] "4944.011474609375",
    [15] "4908.229248046875",
    [16] "4778.435302734375",
    [17] "4489.117919921875"
],
       "min" => [
    [0] 5262,
    [1] 4866,
    [2] 5032,
    [3] 4062,
    [4] 4947,
    [5] 4758,
    [6] 3081,
    [7] 4437,
    [8] 7593,
    [9] 15168,
    [10] 4901,
    [11] 4973,
    [12] 5004,
    [13] 4736,
    [14] 4944,
    [15] 4908,
    [16] 4778,
    [17] 4489
],
  "@version" => "1",
      "host" => "B433",
   "bt_name" => [
    [0] "test"
],
 "timestamp" => [
    [0] 1518044400000,
    [1] 1518087600000,
    [2] 1518109200000,
    [3] 1518130800000,
    [4] 1518174000000,
    [5] 1518195600000,
    [6] 1518217200000,
    [7] 1518260400000,
    [8] 1518368400000,
    [9] 1518411600000,
    [10] 1518433200000,
    [11] 1518454800000,
    [12] 1518476400000,
    [13] 1518519600000,
    [14] 1518541200000,
    [15] 1518562800000,
    [16] 1518606000000,
    [17] 1518627600000
]

```

}  
{  
"@version" =\> "1",  
"host" =\> "B433",  
"path" =\> "C:\Users\186\Downloads\xml\_dev\27.xml",  
"@timestamp" =\> 2018-02-20T18:04:05.642Z,  
"message" =\> " "  
}  
{  
"@version" =\> "1",  
"host" =\> "B433",  
"path" =\> "C:\Users\186\Downloads\xml\_dev\27.xml",  
"@timestamp" =\> 2018-02-20T18:04:05.643Z,  
"message" =\> " "  
}  
{  
"@version" =\> "1",  
"host" =\> "B433",  
"path" =\> "C:\Users\186\Downloads\xml\_dev\27.xml",  
"@timestamp" =\> 2018-02-20T18:04:05.643Z,  
"message" =\> " "  
}  
{  
"@version" =\> "1",  
"host" =\> "B433",  
"path" =\> "C:\Users\186\Downloads\xml\_dev\27.xml",  
"@timestamp" =\> 2018-02-20T18:04:05.644Z,  
"message" =\> " "  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 20, 2018, 6:35pm UTC](https://discuss.elastic.co/t/unable-to-convert-timestamp-to-date-field/120098/10 "2018-02-20T18:35:18Z")

</div>

The `timestamp` field contains an array of timestamps. Which one do you want to parse?

---

<div class="post-metadata">

**Author:** ![Karanushah.1992](https://avatars.discourse-cdn.com/v4/letter/k/e79b87/32.png) [@Karanushah.1992](https://discuss.elastic.co/u/Karanushah.1992)\
**Post date:** [February 20, 2018, 6:36pm UTC](https://discuss.elastic.co/t/unable-to-convert-timestamp-to-date-field/120098/11 "2018-02-20T18:36:04Z")

</div>

I want to parse all timestamps so I can use them to visualize in Kibana

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 20, 2018, 6:42pm UTC](https://discuss.elastic.co/t/unable-to-convert-timestamp-to-date-field/120098/12 "2018-02-20T18:42:06Z")

</div>

Then you can't use the date filter since it doesn't process arrays of input strings. It should be easy to do with a ruby filter, however, but I don't have time to give an example.

---

<div class="post-metadata">

**Author:** ![Karanushah.1992](https://avatars.discourse-cdn.com/v4/letter/k/e79b87/32.png) [@Karanushah.1992](https://discuss.elastic.co/u/Karanushah.1992)\
**Post date:** [February 20, 2018, 6:44pm UTC](https://discuss.elastic.co/t/unable-to-convert-timestamp-to-date-field/120098/13 "2018-02-20T18:44:30Z")

</div>

Can you direct me to similar post where I can try to explore what I am trying to achieve?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2018, 6:44pm UTC](https://discuss.elastic.co/t/unable-to-convert-timestamp-to-date-field/120098/14 "2018-03-20T18:44:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.