Logstash filter to convert “$epoch.$microsec” to “

Question

I am trying to convert a timestamp field that is in the form $epoch.$microsec to $epoch_millis.

Example:

1415311569.541062  -->  1415311569541

Logstash doesn't appear to have any means of multiplying numbers so ts * 1000 and casting to a long is out.

Any ideas?

Answer 1

This is what ended up working.

mutate {
        convert => { 
            "ts" => "string"
        }

        gsub => [
            "ts", "\.", "",
            "ts", "\d{3}$", ""
        ]
}

```

Answer 2

In your particular case you can indeed get away with turning the problem into a string manipulation problem, but you can also use the ruby filter:

filter {
  ruby {
    # do some calculation
    code => "event['ts'] = (1000 * event['ts'].to_f).round"
  }
}