is there a easier way to change the timestamp such that it reflects the servertime when the msg was recieved, and not the stamp set by the equipment sending the msg?
can i do it in the pipeline, with a rule?
im having a lot of issues with timezones, some of the equipment stamps the times an hour wrong,
I have tried with a:
rule “Rotate Timestamp to timestamp” when has_field(“message”)
then
set_field(“timestamp”, to_string($message.Timestamp));
end
Because i have both values in the message allready, the timestamp is the servertime, and the Timestamp is the one from the device.
this doesnt work though…
The “timestamp” field is required to be a proper date/time object.
Try using parse_date() to parse the desired date/time string.
hmmm tried with:
rule "set timestamp"
when
true
then
let new_date = parse_date(to_string($message.timestamp),“yyyy-MM-ddTHH:mm:ss.SSSZ”);
set_field(“Timestamp”, new_date);
end
but then the msg ends in error 
i have got the timestamp syntox as follows:
2018-01-12T11:37:10.526Z
and i’ve tried to match with
yyyy-MM-ddTHH:mm:ss.SSSZ
“Timestamp” and “timestamp” are different fields. You should make up your mind which of both you want to use.
Your previous posts are a bit contradictory to each other.
im sorry if it wasen’t specifik enough.
im trying to set the “timestamp” lower right corner on pic, to the “Timetamp”, Upper left corner
These are already the same (except for the timezone they’re displayed in).
Related GitHub issue:
https://github.com/Graylog2/graylog2-server/issues/2689
thnx 
i found out that libre had just implementet an timezone function against graylog integration, so that it can interpert the timestamps correctly
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
