Parsing UNIX MS Timestamp

Question

Can someone provide a code snippet for parsing unix_ms from the field 'timestamp' in a json log? I'm in a documentation rabbit hole and just need some fresh eyes.

I get 'unsupported timestamp value format float64' but can't see a function to convert.

cbryant · Accepted Answer

This should be what you are looking for:

mutate {
    convert => {
        "timestamp" => "string"
    }
}

date {
    match => [
        "timestamp",
        "UNIX",
        "UNIXMS"
    ]
    on_error => "no_date_match"
}

reference:

Thank you, worked like a charm.

samryanturner · Answer

This should be what you are looking for:

mutate {
    convert => {
        "timestamp" => "string"
    }
}

date {
    match => [
        "timestamp",
        "UNIX",
        "UNIXMS"
    ]
    on_error => "no_date_match"
}

reference:

Thank you, worked like a charm.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded