Search code examples
rubylogstashlogstash-configuration

Converting epoch time to date in logstash using ruby filter

I have a field name "timestamp" in my configuration. It holds an array of data in epoch time (miliseconds). I want to use Ruby filter to convert each epoch time in the array and convert into Date format consumable by Kibana. I am trying to convert each date field and store in a new field as an array. I am getting syntax errors. Can anyone help me out ? I am new to Ruby.

ruby {
code => {'
event.get("timestamp").each do |x| {    
event["timestamp1"] = Time.at(x)
    } 
'}
}
Solution

  • //This will take an timestamp array with values in milliseconds from epoch time and create a new field with parsed time. This code is part of ruby filter Note : This does not convert into Date field format

    code => '
    timestamps = Array.new
    event.get("timestamp").each_with_index { |x, i| 
    timestamps.push(Time.at(x.to_i / 1000)) }
    event.set( "timestamp1" , timestamps)
  '