GELF TCP Input Data to specific index

[gsmith]

@altink

Looks like you have a later version of Graylog. Do you have by default a different order then mine (3.3.2), or would you have to do the same change to achieve what I need?

I had to re-configure my Messages Processor order for my pipeline to work as needed.

EDIT: please take a look here for a HowTo

https://docs.graylog.org/docs/usage

Also another community member had a familiar issue
.

Timestamp from log line in nginx JSON logs via filebeat / beats

Thank you very much for this link, @gsmith ! For some reason I was not able to find it by myself, so these timestamp tag can be really convenient to use. I was able to achieve my goal with this pipeline: rule "parse timestamp" when has_field("time_local") then let new_time = parse_date(value: to_string($message.time_local), pattern:"dd/MMM/yyyy:HH:mm:ss Z"); set_field("timestamp", new_time); end Note, that it is important to configure “Message Processors Configuration” so that “P…