JSON log event with two epoch timestamps

[skelly99]

Hi - I have a JSON formated log file which contains two EPOCH millisecond formatted timestamps

One timestamp relates to the actual time of the log event.

The second timestamp event is the time that the NodeJS process received the request.
Both timestamps are logged as part of the same log event - the log event only being created at response time.

I am extracting the log event timestamp successfully using props.conf settings TIME_PREFIX, & TIME_FORMAT (%s%3N).
This sets the _time value correctly with milliseconds being displayed.

I want to use the second timestamp at search time to calculate the difference between the two timed events in the log.
I am running into issues in converting the second timestamp as it appears the strftime function does not support milliseconds.

  Using  eval ReqTime=strftime(dtime, "%d-%m-%Y %H:%M:%S.%3N") gives a date value of 31-12-9999 23:59:59.999
  Using  eval ReqTime=strftime(dtime/1000, "%d-%m-%Y %H:%M:%S") gives the correct date/time but I lose milliseconds 

Welcome any suggestions on best way to convert the second epoch timestamp but maintaining milliseconds so that I can then calculate the difference between the two times.

Thanks

[woodcock]

Like this:

   ... | eval ReqTime=strftime(dtime/1000, "%d-%m-%Y %H:%M:%S.%6N")

You might have to adjust the 6 to something else (try 3).