I want Kibana to show datetime format standard. I push Bro log via Bro Kafka plugin but It show timestamp format. Can you help me?
You need to tell Elasticsearch to treat that field as a date. Once Elasticsearch knows that it is a date, then Kibana will display it properly.
The Elasticsearch template for Bro that is shipped with Metron can be used as a guide. The template already handles this situation . Either directly install that template or create your own template using Metron's as a guide.
Also, note that the change will only take effect after the index rolls. if the indices roll every hour, then you need to wait until the next hour to see the change. Or if your data is disposable, just delete the index and see your change take effect immediately.
@Lee Adrian i managed to convert timestamp in metron Kibana, what i did was add below Paser config in metron sensor settings.
timestampField - timestamp
if you need more details feel free to contact me.