Hello graylog community.
Today I searched this forum for “Fixing wrong timestamps” and found a solution.
But the solution is silly and slow. How can I fix that?
It is Index ranges wrong - manual recalculation yields dates in the future - #12 by shoothub that does silly
parse_date(value: to_string($message.timestamp), pattern: "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'") - seconds(3600) > now() instead of much more efficient
to_date($message.timestamp) - hours(1) > now().
I came here via “graylog compare timestamp at DuckDuckGo” first hit: “How to transform a timestamp in ms to datetime format?”. I think it would make sense to have something like "If you came here for comparing dates on Graylog 3+, see here: " in that thread.