Changing timestamp to servertime recieved

(John Reyes) #1

is there a easier way to change the timestamp such that it reflects the servertime when the msg was recieved, and not the stamp set by the equipment sending the msg?

can i do it in the pipeline, with a rule?

im having a lot of issues with timezones, some of the equipment stamps the times an hour wrong,

(John Reyes) #2

I have tried with a:

rule “Rotate Timestamp to timestamp” when has_field(“message”)
set_field(“timestamp”, to_string($message.Timestamp));

Because i have both values in the message allready, the timestamp is the servertime, and the Timestamp is the one from the device.

this doesnt work though…

(Jochen) #3

The “timestamp” field is required to be a proper date/time object.

Try using parse_date() to parse the desired date/time string.

(John Reyes) #4

hmmm tried with:

rule "set timestamp"
let new_date = parse_date(to_string($message.timestamp),“yyyy-MM-ddTHH:mm:ss.SSSZ”);
set_field(“Timestamp”, new_date);

but then the msg ends in error :confused:

(John Reyes) #5

i have got the timestamp syntox as follows:
and i’ve tried to match with

(Jochen) #6

“Timestamp” and “timestamp” are different fields. You should make up your mind which of both you want to use.
Your previous posts are a bit contradictory to each other.

(John Reyes) #7

im sorry if it wasen’t specifik enough.

im trying to set the “timestamp” lower right corner on pic, to the “Timetamp”, Upper left corner

(Jochen) #8

These are already the same (except for the timezone they’re displayed in).

Related GitHub issue:

(John Reyes) #9

thnx :slight_smile:
i found out that libre had just implementet an timezone function against graylog integration, so that it can interpert the timestamps correctly

(system) #10

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.