How to transform a timestamp in ms to datetime format?

[jochen]

Graylog 3.0.0 will come with a pipeline function for that: parse_unix_milliseconds().

In Graylog 2.x, there’s unfortunately no simple way to achieve this, since parse_date() doesn’t support creating a date from a UNIX epoch timestamp.

You can try the workaround described in Epoch time to readable datetime stamp.