How to copy timestamp to timereadtime then change timestamp to real time?

Graylog Central (peer support)
,
1

Hi

I want to copy timestamp to new field “logreadtime”
then, change timestamp to time in raw log
But It doesn’t work, Why(detail as below)?

There is a log with fields:
Routed into streams: CISCO
YEAR: 2019
MONTH: Apr
MONTHDAY: 1
HOUR: 06
MINUTE: 07
SECOND: 41.176
TIME: 06:07:41.176

I created a rule(as below) and link it to a pipeline ‘CISCO’

Pipeline ‘CISCO’
Connect to stream ‘CISCO’
Stage 0 with a rule “Save and update timestamp”

rule “Save and update timestamp”
when
true
then
set_field(“logreadtime”, $message.timestamp);
let new_date = parse_date(
value: to_string($message.YEAR) + “-” + to_string($message.MONTH) + “-” + to_string($message.MONTHDAY) + “T” + to_string($message.TIME),
pattern: “yyyy-MMM-d’T’HH:mm:ss.SSS”
);
set_field(“timestamp”, new_date);
end

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.