Epoch time to readable datetime stamp

Graylog Central (peer support)
8

Yes, but it’s a bit of a hack. :wink:

The idea is to convert the number of seconds (here in the field “unix_timestamp”) to a time period with seconds() and then add it to the UNIX epoch:

rule "UNIX timestamp"
when
  has_field("unix_timestamp")
then
  // UNIX epoch
  let epoch = parse_date("1970-01-01T00:00:00.000Z", "yyyy-MM-dd'T'HH:mm:ss.SSSZ");
  let ts_seconds = seconds(to_long($message.unix_timestamp));
  set_field("timestamp", epoch + ts_seconds);
end

Of course having a function converting directly from UNIX time to a proper timestamp would be preferable, but that doesn’t exist out of the box in Graylog.

This being said, feel free to create a feature request at Issues · Graylog2/graylog-plugin-pipeline-processor · GitHub

3 Likes