Watcher, Transform UTC timestamp on the payload to local time

Elastic Stack Elasticsearch
1

In the payload of a watcher I have the timestamp field

"@timestamp" : "2020-09-23T23:11:24.359Z",

But this field is in UTC, and I want to change it to local time, I have tried the folowing

  "actions": {
    "send_email": {
      "transform": {
        "script": """
return ['date': Instant.ofEpochMilli(ctx.payload.hits.hits.0._source.@timestamp).atZone(ZoneId.of("America/Lima"))]"""
      },

but it trows me an error

    "reason" : "compile error",
    "script_stack" : [
      "... load.hits.hits.0._source.@timestamp).atZone(ZoneId ...",
      "                             ^---- HERE"
    ],

What should I do to make it work?

1 Like
2

I think you may need to use ctx.payload.hits.hits.0._source['@timestamp'] in the script

2 Likes
3

Thanks Russ, that worked.....but now It gives me another error

"caused_by" : {
                "type" : "class_cast_exception",
                "reason" : "class java.lang.String cannot be cast to class java.lang.Number (java.lang.String and java.lang.Number are in module java.base of loader 'bootstrap')"
              }
4

The @timestamp is in ISO8601 string format, so in order to parse this into a ZonedDateTime, you'd need to use something like

ZonedDateTime zdt = ZonedDateTime.parse(ctx.payload.hits.hits.0._source['@timestamp']);

Take a look at the Datetime parsing and formatting Painless reference.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.