I’ve found plenty of posts about this, but for whatever reason, I just can’t get it to work following the instructions I’ve found.
I chose to use Filebeats to send my IIS-logs to Graylog2, and I’m using an extractor to pull the message apart into all of it’s separate fields, and this works just fine.
I also have a pipeline that goes through the field log_timestamp to change it into a correct timestamp (including timezone) and then save it with my local timezone, and this works just perfectly.
But the part of my pipeline that is supposed to modify timestamp to use the timestamp from the log, not from time of harvest/ingest/shipping, just doesn’t seem able to overwrite the field timestamp.
I’ve had it store the value in a third field just to see the output, and it looks correct (same format as the current timestamp) so the format should be ok. I haven’t found any errors implying a misconfiguration so I can’t figure out why it isn’t working.
I must be missing something since other people got it working, I hope someone can help out!
The pipeline looks like this: https://github.com/flatrick/graylog2_iis#set-timestamps-to-timestamps-from-log-not-from-time-of-harvest
I’m currently documenting the steps I’ve taken in this setup on my github, if I’ve missed to write down something important for you to help me, let me know!