Epoch time fields in pipeline rule

[derPhlipsi (Philipp Ruland)]

Heyo @mmurdock,

I don’t think that you’re doing anything wrong.
Let Graylog do a statistical chart against the timestamp field of the message itself. It’ll convert the timestamps to epoch seconds. I think this has to do with some internal conversion or fallbacks of the displaying libraries.

But I have some pointers for you:

How to transform a timestamp in ms to datetime format?

Graylog 3.0.0 will come with a pipeline function for that: parse_unix_milliseconds(). In Graylog 2.x, there’s unfortunately no simple way to achieve this, since parse_date() doesn’t support creating a date from a UNIX epoch timestamp. You can try the workaround described in Epoch time to readable datetime stamp.

Epoch time to readable datetime stamp

Yes, but it’s a bit of a hack. The idea is to convert the number of seconds (here in the field “unix_timestamp”) to a time period with seconds() and then add it to the UNIX epoch: rule "UNIX timestamp" when has_field("unix_timestamp") then // UNIX epoch let epoch = parse_date("1970-01-01T00:00:00.000Z", "yyyy-MM-dd'T'HH:mm:ss.SSSZ"); let ts_seconds = seconds(to_long($message.unix_timestamp)); set_field("timestamp", epoch + ts_seconds); end Of course having a function convert…

But I guess you already saw this topic since you are using the seconds() function

Greetings,
Philipp