Zeek ingest pipeline ignores millisecond in the timestamp

[inqueue]

• Version: Filebeat 7.4.2
• Operating System: n/a

Zeek logs may have milliseconds in the timestamp like this: 1573757353.774572. When it happens, the statement ctx['@timestamp'] = (long)ctx['zeek']['notice']['ts'] * 1000; turns the value into 1573757353000.

Making the statement ctx['@timestamp'] = (long)(ctx['zeek']['notice']['ts'] * 1000) solves the issue.

@andrewkroh

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[andrewkroh]

It looks like the latest version in master does the conversion in a slightly different manner.

beats/x-pack/filebeat/module/zeek/connection/ingest/pipeline.json

Lines 11 to 15 in ee5a4e7

	"date": {
	"field": "zeek.connection.ts",
	"formats": ["UNIX"]
	}
	},

And it does preserve the milliseconds part of the timestamp:

beats/x-pack/filebeat/module/zeek/connection/test/connection-json.log-expected.json

Line 3 in ee5a4e7

"@timestamp": "2019-01-11T06:33:35.857Z",

So we might just want to backport these latest changes to 7.5 and 7.x.