Changing timestamp to servertime recieved


(John Reyes) #1

is there a easier way to change the timestamp such that it reflects the servertime when the msg was recieved, and not the stamp set by the equipment sending the msg?

can i do it in the pipeline, with a rule?

im having a lot of issues with timezones, some of the equipment stamps the times an hour wrong,


(John Reyes) #2

I have tried with a:

rule “Rotate Timestamp to timestamp” when has_field(“message”)
then
set_field(“timestamp”, to_string($message.Timestamp));
end

Because i have both values in the message allready, the timestamp is the servertime, and the Timestamp is the one from the device.

this doesnt work though…


(Jochen) #3

The “timestamp” field is required to be a proper date/time object.

Try using parse_date() to parse the desired date/time string.


(John Reyes) #4

hmmm tried with:

rule "set timestamp"
when
true
then
let new_date = parse_date(to_string($message.timestamp),“yyyy-MM-ddTHH:mm:ss.SSSZ”);
set_field(“Timestamp”, new_date);
end

but then the msg ends in error :confused:


(John Reyes) #5

i have got the timestamp syntox as follows:
2018-01-12T11:37:10.526Z
and i’ve tried to match with
yyyy-MM-ddTHH:mm:ss.SSSZ


(Jochen) #6

“Timestamp” and “timestamp” are different fields. You should make up your mind which of both you want to use.
Your previous posts are a bit contradictory to each other.


(John Reyes) #7

im sorry if it wasen’t specifik enough.

im trying to set the “timestamp” lower right corner on pic, to the “Timetamp”, Upper left corner


(Jochen) #8

These are already the same (except for the timezone they’re displayed in).

Related GitHub issue:


(John Reyes) #9

thnx :slight_smile:
i found out that libre had just implementet an timezone function against graylog integration, so that it can interpert the timestamps correctly


(system) #10

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.