Pipeline rule on ingested JSON data via Filebeat and NDJSON parser

Graylog Central (peer support)
,
2

Hello && Welcome @foobug

Correct me if I’m wrong you need a pipe for epoch time? if so here is an example

rule "Jira | Replace @timestamp with application.audit.timestamp.epochSecond for audit logs"
when
    true
then
  let ts_millis = to_long($message.application.audit.timestamp.epochSecond) / 1000000;
  let new_date = parse_unix_milliseconds(ts_millis);
  set_field("epoch_timestamp", new_date);
  set_field("timestamp", new_date);
end

divide unix timestamp in nanoseconds by 1000000 and you have miliseconds. Then use it in function parse_unix_milliseconds()

Some findings;