Parsing UNIX MS Timestamp

[samryanturner]

Can someone provide a code snippet for parsing unix_ms from the field 'timestamp' in a json log? I'm in a documentation rabbit hole and just need some fresh eyes.

I get 'unsupported timestamp value format float64' but can't see a function to convert.

[cbryant · Accepted solution]

This should be what you are looking for: 

mutate {
    convert => {
        "timestamp" => "string"
    }
}

date {
    match => [
        "timestamp",
        "UNIX",
        "UNIXMS"
    ]
    on_error => "no_date_match"
}

reference:

• https://cloud.google.com/chronicle/docs/reference/parser-syntax#convert_functions
• https://cloud.google.com/chronicle/docs/reference/parser-syntax#date_function 

[samryanturner]

Thank you, worked like a charm.