Timestamp configuration in props for epoch time

Tamilraj28 — Thu, 31 Dec 2020 12:13:52 GMT

Dear All,

I am getting data from the Search head in json format. The first field of the event is timestamp and it is in epoch time format("timestamp": 1609414219738696) with 16 digits.

My problem is i need to onboard data with _time value from timestamp field. So in props.conf file of Cluster master i updated as below

TIMESTAMP_FIELDS = timestamp
TIME_FORMAT = %s%6N

But the _time field is not populated properly . And i am getting 2 values in indexed data for timestamp field as below.

Please help me on this

Re: Timestamp configuration in props for epoch time

anwarmian — Sun, 18 Jan 2026 22:02:02 GMT

Hello Tamilraj28,
You may have already found your solution, but here is one.
Since it is a json file and not a csv, and the timestamp needs to be extracted before the json fields are available you need to use TIME_PREFIX not TIMESTAMP_FIELDS. in your case you need to add:

TIME_PREFIX = timestamp":

topic Timestamp configuration in props for epoch time in Getting Data In

Timestamp configuration in props for epoch time

Re: Timestamp configuration in props for epoch time