Parsing unix milisecond timestamps

[NeilJed]

My JSON events log their timestamp as a unix timestamp in miliseconds, i.e. 1704895500140. I want to parse these into a timestamp object so I can reformat them as something more human readable in the output.

With parse_timestamp I've tried both %s%fand %s%3f`for the format string but just get Invalid Timestamp errors.

Can anyone suggest a way to parse these correctly?

[jszwedko]

I think the easiest thing to do would be to convert it to an integer (parse_int) and use https://vector.dev/docs/reference/vrl/functions/#from_unix_timestamp. Ideally you could parse the string too using parse_timestamp but the library we use for date parsing doesn't support it.

[NeilJed]

Thanks @jszwedko - I'd forgotten about the from_unix_timestamp function.

I did get it working by dividing it by 1000 and then using %s%.3f for parse_format but compared to your way thats long the long way around.

The following is what I came up with that worked as desired:

ts = from_unix_timestamp!(value: int!(.timestamp), unit: "milliseconds")
.timestamp = format_timestamp!(value:ts, format: "%+", timezone: "UTC")