Skip to main content

Hello,

I have EPOCH "time": 1723791636 in the raw log which i want to parse and map to the udm.metadata.collected_timestamp.seconds .

But, when i try to map it doesn't show in the output, without any error.

Can anyone help me with this ?

 

Hi @sudeep_singh,


How are you mapping it to udm.metadata.collected_timestamp.seconds? Can you post the snippet? 

Try something like this. Any date filters formats from logstash such as UNIX and UNIX_MS should work. With date filter you can ignore the .seconds, the filter handles the proto conversion internally.  (Reference)

 
date {
match => ["time", "UNIX"]
target => "event.idm.read_only_udm.metadata.collected_timestamp"
on_error => "_"
}

 

 

Try something like this. Any date filters formats from logstash such as UNIX and UNIX_MS should work. With date filter you can ignore the .seconds, the filter handles the proto conversion internally.  (Reference)

 
date {
match => ["time", "UNIX"]
target => "event.idm.read_only_udm.metadata.collected_timestamp"
on_error => "_"
}

 

 


Hi @citreno,

I have find out the same thing from the community.

thank you.

Hi @sudeep_singh,


How are you mapping it to udm.metadata.collected_timestamp.seconds? Can you post the snippet? 


Hi @Rene_Figueroa,

I got the solution which is similar to @citreno post.

Reply


Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.