i want to change the timestamp format from yyyy-MM-dd HH:mm:ss.SSS Z to yyyy/MM/dd HH:mm:ss.SSS Z with pipeline rule but when i create a rule below it’s seem not work.
Graylog version 4.1
Guest OS: Ubuntu 20.
When modifying the timestamp I like to assign to a temporary field first while testing. Then you don’t get caught out by messages not showing up in the search because e.g. they end up being in a different timezone.
Also check the processing failure stream for error messages.
I have this in my tool kit not sure it it will work for ya.
rule "replace timestamp"
let new_date = parse_date(to_string($message.timestamp), "yyyy-MM-dd'T'HH:mm:ss.SSS","CST"); ///Centeral time Zone
yeah sure, but i think the new format timestamp is incorrect, my idea is when i have a message with timestamp like 2023-01-13 11:10:48.000 +07:00 and the pipeline will change it to (dd/MM/yyyy hh:mm:ss.S timezone. example: 13/01/2023 11:10:48 +07:00)
I really dont know. I would take a guess probably , first I would see if elasticearch would be able to to that. Perhaps create a new index template for a new index set. This way is something goes horribly wrong your not going to mess up all your indices.