Clever Geek Handbook

Logstash filter to convert "$ epoch. $ Microsec" to "$ epoch_millis"

I am trying to convert a timestamp field that is in the form $epoch.$microsec

- $epoch_millis

.

Example:

1415311569.541062  -->  1415311569541

Logstash does not have any means of multiplying numbers, so it ts * 1000

does not cast to the end.

Any ideas?

+3


source to share


2 answers


In your specific case, you can indeed get away by turning the problem into a string manipulation problem, but you can also use a filter ruby

:



filter {
  ruby {
    # do some calculation
    code => "event['ts'] = (1000 * event['ts'].to_f).round"
  }
}
+4


source


Here's what happened.

mutate {
        convert => { 
            "ts" => "string"
        }

        gsub => [
            "ts", "\.", "",
            "ts", "\d{3}$", ""
        ]
}


``,

+2


source






More articles:


All Articles