Fortigate changed eventtime from seconds to nanoseconds

Graylog Central (peer support)
,
2

I think, it’s very simple and straightforward, simply divide unix timestamp in nanoseconds by 1000000 and you have miliseconds. Then use it in function parse_unix_milliseconds()

rule "Epoch Convert"
when
  has_field("devname") && has_field("date") && has_field("time") && has_field("eventtime")
then
  let ts_millis = to_long($message.eventtime) / 1000000;
  let new_date = parse_unix_milliseconds(ts_millis);
  set_field("epoch_timestamp", new_date);
  set_field("timestamp", new_date);
end