How to transform a timestamp in ms to datetime format?

Graylog Central (peer support)
1

How to transform a timestamp in ms to datetime format?

for example, i want to tranform a timestamp like 1514736000000 to a datetime format 2018-01-01 00:00:00.000.

also can we directly compare the datetime with > < == or != ?

2

Graylog 3.0.0 will come with a pipeline function for that: parse_unix_milliseconds().

In Graylog 2.x, there’s unfortunately no simple way to achieve this, since parse_date() doesn’t support creating a date from a UNIX epoch timestamp.

You can try the workaround described in Epoch time to readable datetime stamp.

1 Like
3

it seems when i compare an DateTime object to each other with < or >. systemctl try to cast it into long, and all input message stuck in message journal:

image
image.png992Ă—425 68.2 KB

and error report by graylog:

2018-04-18T17:02:46.446+08:00 WARN  [ProcessBufferProcessor] Unable to process message <430acce0-42e7-11e8-86d6-525400cde656>: java.lang.ClassCastException: org.joda.time.DateTime cannot be cast to java.lang.Long

after rewrite the pipeline rules, how to restart to processing those messages in journal?

4

after correct the rules, the processing of message journal move forward.

5

on this other side, can we convert a datetime to long ? i just need compare the log time to now() to make sure the log time is not later than time we analysis it. of course if there is a compare methods(==, !=, <, >, <=, >= ) implementation between datetime objects would be great.

6

it seems that i got wrong datetime by this way.

my caculation as:

	let epoch = parse_date("1970-01-01 00:00:00.000", "yyyy-MM-dd HH:mm:ss.SSS");
	let ts_ms = to_long($message.x2_procedure_end_time_input);
	let end_time = format_date(epoch + millis(ts_ms),"yyyy-MM-dd HH:mm:ss.SSS","+08:00");
	set_field("x2_procedure_end_ms",ts_ms);
	set_field("x2_procedure_end_time",end_time);
	remove_field("x2_procedure_end_time_input");

but i got a result as:

image

where 1519488016350 should be beijing time 2018-02-25 00:00:16.350 instead of 1970-01-26 04:31:23.647

7

eventually found can be caculated as following:

	let epoch = parse_date("1970-01-01 00:00:00.000", "yyyy-MM-dd HH:mm:ss.SSS");
	let ts_ms = to_long($message.x2_procedure_end_time_input);
	let end_time = to_date(epoch + seconds(ts_ms/1000) + millis(ts_ms%1000),"+08:00");
	set_field("x2_procedure_end_ms",ts_ms);
	set_field("x2_procedure_end_time",format_date(end_time,"yyyy-MM-dd HH:mm:ss.SSS","+08:00"));
	remove_field("x2_procedure_end_time_input");

but i cannot achieve a “>” compare between log time and now() in the when condition.

8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.