Grok Extractor Try succeeds, but not fields in search

[gsmith]

Here is a starter if need be.

Timestamp Replacement Issues (Ingestion timestamp vs log timestamp)

I did some troubleshooting and I can confirm that the pipeline is processing my messages, just isn’t doing what it’s supposed to do. I change my pipeline rule to set a static value for a field. rule “parse right timestamp” when has_field(“timestamp_orig”) then let new_date = parse_date(to_string($message.timestamp_orig)); set_field(“beat_hostname”, “taco”); end [11%20PM] When I just change the set_field to the variable it reverts back the hostname and not the time stamp. rule “par…