# How to create field "ts\_name" and connect it to the portion of the log lines between two timestamps(start and end)?

**URL:** <https://community.graylog.org/t/how-to-create-field-ts-name-and-connect-it-to-the-portion-of-the-log-lines-between-two-timestamps-start-and-end/13436>\
**Category:** Graylog Central (peer support)\
**Created:** [January 11, 2020, 12:33am UTC](https://community.graylog.org/t/how-to-create-field-ts-name-and-connect-it-to-the-portion-of-the-log-lines-between-two-timestamps-start-and-end/13436 "2020-01-11T00:33:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dmirc](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/dmirc/32/5379_2.png) [@dmirc](https://community.graylog.org/u/dmirc)\
**Post date:** [January 11, 2020, 12:33am UTC](https://community.graylog.org/t/how-to-create-field-ts-name-and-connect-it-to-the-portion-of-the-log-lines-between-two-timestamps-start-and-end/13436/1 "2020-01-11T00:33:34Z")

</div>

Hi,

Basically I have a big log with a lot of lines that are all connected to some of the Tests in Jenkins(for example ID: Ts4567, Ts7890, Ts1234, etc).

Now the point what I want to achieve is for example: I want to write in search ts\_name: Ts4567 and then in output(Messages block in Graylog GUI), there should be listed only lines that are connected to this field, between two timestamps(start and the end).

How should I make this happen? Via Pipeline maybe? If someone can write the example I would appreciate it much. Thanks!

Let’s say the parameters are:

```auto
ID of the Test: Ts4567
Start: 2019-12-03T07:49:44,702
End: 2019-12-03T07:52:14,463

```

Note: **Not every line consist Ts4567, so I can’t just type “Ts4567” in the search and get all the lines. I need to use timestamps and somehow connect these lines to the field, and after that search for it.**

Timestamp is in message field. Look example of a log line bellow:

```auto
message
2019-12-03T07:50:43,011 TRACE o.a.k.c.p.i.ProducerBatch [kafka-producer-network-thread | producer-3] Successfully produced messages to dev_module_0_storage_priority-0 with base offset 30498.

```

---

<div class="post-metadata">

**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\
**Post date:** [January 12, 2020, 3:11pm UTC](https://community.graylog.org/t/how-to-create-field-ts-name-and-connect-it-to-the-portion-of-the-log-lines-between-two-timestamps-start-and-end/13436/2 "2020-01-12T15:11:25Z")

</div>

Unfortunately graylog cant make connection between logs.  
May be you can write script what make elasticsearch querres to find the start and and time, Than write it back to the log line.

---

<div class="post-metadata">

**Author:** ![dmirc](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/dmirc/32/5379_2.png) [@dmirc](https://community.graylog.org/u/dmirc)\
**Post date:** [January 13, 2020, 12:34pm UTC](https://community.graylog.org/t/how-to-create-field-ts-name-and-connect-it-to-the-portion-of-the-log-lines-between-two-timestamps-start-and-end/13436/3 "2020-01-13T12:34:32Z")

</div>

something like this wont work? (for now it doesn’t but maybe im close?)

"  
rule “parse event timestamp”  
when  
to\_date (value: “2019-12-03T07:49:50,751”) \< to\_date (value: $message.newtimestamp) && to\_date (value: “2019-12-03T07:50:43,895”) \> to\_date (value: $message.newtimestamp)  
then  
set\_field(“test\_id”, “Ts5963”);  
end  
"

---

<div class="post-metadata">

**Author:** ![dmirc](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/dmirc/32/5379_2.png) [@dmirc](https://community.graylog.org/u/dmirc)\
**Post date:** [January 15, 2020, 1:14pm UTC](https://community.graylog.org/t/how-to-create-field-ts-name-and-connect-it-to-the-portion-of-the-log-lines-between-two-timestamps-start-and-end/13436/4 "2020-01-15T13:14:46Z")

</div>

This is solution:

> rule “parse event timestamp and add field”  
> when  
> parse\_date(to\_string($message.newtimestamp),“YYYY-MM-dd’T’HH:mm:ss.SSS”) \>=  
> parse\_date(to\_string(“2019-12-03T07:49:50.751”),“YYYY-MM-dd’T’HH:mm:ss.SSS”) &&  
> parse\_date(to\_string($message.newtimestamp),“YYYY-MM-dd’T’HH:mm:ss.SSS”) \<= parse\_date(to\_string(“2019-12-03T07:50:43.895”),“YYYY-MM-dd’T’HH:mm:ss.SSS”)  
> then  
> set\_field(“nts”, “TS-5963”);  
> end

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [January 29, 2020, 1:24pm UTC](https://community.graylog.org/t/how-to-create-field-ts-name-and-connect-it-to-the-portion-of-the-log-lines-between-two-timestamps-start-and-end/13436/5 "2020-01-29T13:24:02Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.