# Fortigate changed eventtime from seconds to nanoseconds

**URL:** <https://community.graylog.org/t/fortigate-changed-eventtime-from-seconds-to-nanoseconds/18772>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules, time-stamp-issuespl\
**Created:** [February 11, 2021, 1:27pm UTC](https://community.graylog.org/t/fortigate-changed-eventtime-from-seconds-to-nanoseconds/18772 "2021-02-11T13:27:15Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [February 11, 2021, 6:49pm UTC](https://community.graylog.org/t/fortigate-changed-eventtime-from-seconds-to-nanoseconds/18772/2 "2021-02-11T18:49:40Z")

</div>

I think, it’s very simple and straightforward, simply divide unix timestamp in nanoseconds by 1000000 and you have miliseconds. Then use it in function `parse_unix_milliseconds()`

```auto
rule "Epoch Convert"
when
  has_field("devname") && has_field("date") && has_field("time") && has_field("eventtime")
then
  let ts_millis = to_long($message.eventtime) / 1000000;
  let new_date = parse_unix_milliseconds(ts_millis);
  set_field("epoch_timestamp", new_date);
  set_field("timestamp", new_date);
end

```

---

_[View the full topic](https://community.graylog.org/t/fortigate-changed-eventtime-from-seconds-to-nanoseconds/18772)._