自纪元以来的Logstash日期解析失败，以毫秒为单位

Question

Logstash is not able to parse milliseconds since epoch and returns me an parse failure. There are no whitspaces in the content of the timestamo field in the xml and logstash selects the right value.

filter {
    xml {
            source => "message"
            remove_namespaces => true
            store_xml => false
            xpath => ["//event/@timestamp", "@time_since_epoch"]
    }

    date {
            match => [ "@time_since_epoch","UNIX_MS" ]
            target => "@time"
    }
}

What I am doing wrong?

EDIT

sample xml data line:

<event timestamp="1494599590213" ><message>Dummy message</message></event>

Answer 1

Apparently the value extracted from the xpath is put in an array (see: "@time_since_epoch":["1494599590213"] with the stdout plugin and the json codec).

So you'll need to access the time as an array element:

date {
        match => [ "[@time_since_epoch][0]","UNIX_MS" ]
        target => "@time"
}