Can't overwrite timestamp through pipeline-rule

Graylog Central (peer support)
,
5

You make it to complex:

rule "correct timestamp for logs from IIS"
when
    contains(
            value: to_string($message.type), 
            search: "iis",
            ignore_case: true)
    AND has_field(field: "log_timestamp")
then
    let log_timestamp = $message.log_timestamp;
    let timestamp = $message.timestamp;
   
    debug(value: concat(
                    first: "timestamp before changing: ",
                    second: to_string(timestamp)));
	debug(value: concat(
                    first: "log_timestamp: ",
                    second: to_string(log_timestamp)));
	
    let time = parse_date( value: to_string(log_timestamp),
                           pattern: "yyyy-MM-dd HH:mm:ss Z");
                           
    set_field("timestamp", time)

	debug(value: concat(
                    first: "After changing: ",
	                second: to_string(timestamp)));
end

just parse the date you want to have and then set the parsed as time - graylog/elasticsearch will take care that the time is formatted in the right way.

The above should work, not sure about the debug statements.