Created on 03-30-2017 10:10 AM - edited 08-18-2019 02:09 AM
I want Kibana to show datetime format standard. I push Bro log via Bro Kafka plugin but It show timestamp format. Can you help me?
Created 03-30-2017 07:59 PM
You need to tell Elasticsearch to treat that field as a date. Once Elasticsearch knows that it is a date, then Kibana will display it properly.
The Elasticsearch template for Bro that is shipped with Metron can be used as a guide. The template already handles this situation . Either directly install that template or create your own template using Metron's as a guide.
Also, note that the change will only take effect after the index rolls. if the indices roll every hour, then you need to wait until the next hour to see the change. Or if your data is disposable, just delete the index and see your change take effect immediately.
Created 03-31-2017 02:48 AM
Hi @nallen. Thank you for your reply. I try to change "format": "strict_date_optional_time||epoch_millis" and delete index but Kibana don't display it properly.
Created 10-17-2017 02:41 PM
@Lee Adrian @nallen I also ran into the same issue. I changed ElasticSearch templates as well as storm parser for each data type, but it's still epoch_millis. I wonder do I need to change the sensor configuration itself? The epoch time is not useful to the users b/c they have to convert it
Created 11-17-2017 01:00 PM
@Lee Adrian i managed to convert timestamp in metron Kibana, what i did was add below Paser config in metron sensor settings.
timestampField - timestamp
if you need more details feel free to contact me.