Display timestamp through "split and index"

Graylog Central (peer support)
1

I have created an extractor using “split and index” whereby the message time stamp is split up into the date and then the time. (At the moment I am just trying to display the time). I saved this into a field called timestamp, but I am unable to call this message in a notification. (the split works fine in the extraction tool)

I have tried the following lines but it will not display, I just get the error shown below:

Date: {message.timestamp.date_syslog} Date: {message.timestamp.fields.date_syslog}

The Graylog server encountered an error while trying to send an email. This is the detailed error message: com.floreysoft.jmte.message.ParseException: Error while parsing ‘message.timestamp.date_syslog’ at location (14:9): Property ‘date_syslog’ on object ‘2017-10-21T19:28:19.606Z’ can not be accessed: “java.lang.NoSuchFieldException: date_syslog”!

2

The error message simply says that not all messages triggering the alert have the referenced field “date_syslog”.

3

okay thanks., so when I open a syslog message there is a timestamp, although it is not part of the message stream. How do I include this timestamp?

4

Taking a closer look on your template from the first post, you’re not using the template variables correctly.

The part of your template should probably be as follows:

Date: {message.fields.date_syslog}

But alas it’s hard to say without knowing the configuration of your extractor(s) and some messages you’re processing.

5

Its a syslog message that contains no timestamp in the actual message, but I noticed when I open the message graylog adds a timestamp. How do I reference this timestamp in a notification?

6

Either ${message.timestamp} (because it’s a special field like message and source) or ${message.fields.timestamp} (if you want to stay consistent with field access to other message fields).

7

Great, thank you so much… that worked… however I have one last question. How can I do the following

go from:
DATE: 2017-10-22T15:36:52.117Z
to:
DATE: 2017-10-22
TIME: 15:36:52

8

Unless there are fields containing that very information (and nothing else), that’s not possible.

You can only reference complete message fields in the email template, but not parts of fields or execute operations on them.

9

I created a extractor based on time stamp (split and index) and was able to get this information seperated, but I don’t know how to reference it in the template

10

Nevermind… figured it out… thanks so much for your help!!! you have been great.

11

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.