Logstash filter to convert "$ epoch. $ Microsec" to "$ epoch_millis"
I am trying to convert a timestamp field that is in the form $epoch.$microsec
- $epoch_millis
.
Example:
1415311569.541062 --> 1415311569541
Logstash does not have any means of multiplying numbers, so it ts * 1000
does not cast to the end.
Any ideas?
+3
Jason trost
source
to share
2 answers
In your specific case, you can indeed get away by turning the problem into a string manipulation problem, but you can also use a filter ruby
:
filter {
ruby {
# do some calculation
code => "event['ts'] = (1000 * event['ts'].to_f).round"
}
}
+4
Magnus Bäck
source
to share
Here's what happened.
mutate {
convert => {
"ts" => "string"
}
gsub => [
"ts", "\.", "",
"ts", "\d{3}$", ""
]
}
``,
+2
Jason trost
source
to share