Changing timestamp to servertime recieved

is there a easier way to change the timestamp such that it reflects the servertime when the msg was recieved, and not the stamp set by the equipment sending the msg?

can i do it in the pipeline, with a rule?

im having a lot of issues with timezones, some of the equipment stamps the times an hour wrong,

I have tried with a:

rule “Rotate Timestamp to timestamp” when has_field(“message”)
set_field(“timestamp”, to_string($message.Timestamp));

Because i have both values in the message allready, the timestamp is the servertime, and the Timestamp is the one from the device.

this doesnt work though…

The “timestamp” field is required to be a proper date/time object.

Try using parse_date() to parse the desired date/time string.

hmmm tried with:

rule "set timestamp"
let new_date = parse_date(to_string($message.timestamp),“yyyy-MM-ddTHH:mm:ss.SSSZ”);
set_field(“Timestamp”, new_date);

but then the msg ends in error :confused:

i have got the timestamp syntox as follows:
and i’ve tried to match with

“Timestamp” and “timestamp” are different fields. You should make up your mind which of both you want to use.
Your previous posts are a bit contradictory to each other.

im sorry if it wasen’t specifik enough.

im trying to set the “timestamp” lower right corner on pic, to the “Timetamp”, Upper left corner

These are already the same (except for the timezone they’re displayed in).

Related GitHub issue:

thnx :slight_smile:
i found out that libre had just implementet an timezone function against graylog integration, so that it can interpert the timestamps correctly

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.