How to convert EPOCH time to UTC ?

[sudeep_singh]

Hello,

I have EPOCH "time": 1723791636 in the raw log which i want to parse and map to the udm.metadata.collected_timestamp.seconds .

But, when i try to map it doesn't show in the output, without any error.

Can anyone help me with this ?

[Rene_Figueroa]

Hi @sudeep_singh,

How are you mapping it to udm.metadata.collected_timestamp.seconds? Can you post the snippet? 

[sudeep_singh]

Hi @Rene_Figueroa,

I got the solution which is similar to @citreno post.

[citreno]

Try something like this. Any date filters formats from logstash such as UNIX and UNIX_MS should work. With date filter you can ignore the .seconds, the filter handles the proto conversion internally.  (Reference)

date {

match => ["time", "UNIX"]

target => "event.idm.read_only_udm.metadata.collected_timestamp"

on_error => "_"

}

[sudeep_singh]

Hi @citreno,

I have find out the same thing from the community.

thank you.