Hi there, Description of your problem I’m receiving nginx error log messages on a syslog input and try to read the timestamp from the message. I created an extractor that extracts timestamp from the message: [image] Extractor works^^ Then I added a date-time converter and configured it like th…

Hello there! So i got the exact same problem after i updated to graylog 4.2.0 Seems to be a problem with the update.

Hello I noticed your Date Format string is yyyy/MM/dd HH:mm:ss. [image] aft2d: caused exception: Invalid format Not 100% sure but I think it might be from your forward slashes. Maybe try this configuration yyyy-MM-dd HH:mm:ss.SSS Below worked in my lab. [image] Hope that helps

Hi, I followed your suggestion and used: yyy-MM-dd HH:mm:ss Unfortunately with the same result. I mean, I need to use the slashes? My input string is 2021/10/22 08:42:47 for example, and I can’t change it. That’s also why I need to use the Date converter.

Sadly this didnt work out for me as well. I also tried to change the date thats delivered to graylog by my powershell script but nothing worked. My config is pretty much the same as the one from @aft2d .

Ok so when trying to copy the needed timestamp from the message and convert it into another field i.e. timestamp2 everything works just fine. [grafik] You can notice the difference of the format between the two timestamps. Maybe this matters?

Hello, [image] Winklerschulbedarf: convert it into another field i.e. timestamp2 How did you go about converting it? Pipeline? If you have a field called “timestamp” already you can covert it via pipeline but I believe If you creating a regular expression you cant use the same field you hav…

Hello, Can you show by example the date/time from nginx message your trying to extract? On another note if you created a new field for you Regex then instead of using a converter maybe a pipeline would help. https://docs.graylog.org/docs/functions#parse-date Maybe something like this. rule “pa…

[image] Winklerschulbedarf: Ok so when trying to copy the needed timestamp from the message and convert it into another field i.e. timestamp2 everything works just fine. [grafik] You can notice the difference of the format between the two timestamps. Maybe this matters? I can reproduce thi…

I found another post with the same issue. Might want to check it out. [image] Nginx log access time stamps cannot be converted Graylog Central (peer support) See http://docs.graylog.org/en/2.4/pages/pipelines/functions.html#parse-date .

Not sure if this helps, but I came across this post earlier today with a similar issue with Nginx [image] Graylog exctractor specify timezone other than UTC Graylog Central (peer support) Hello team! I have a message with timestamp without specified timezone in it, but t…

Issues with date type converter format string

Graylog Central (peer support)

gsmith (GSmith) October 28, 2021, 4:46am 11

Not sure if this helps, but I came across this post earlier today with a similar issue with Nginx

Topic		Replies	Views
Timestamp extractor error Graylog Central (peer support) pipeline-rules	2	1002	December 31, 2021
Problem with date extractor converter Graylog Central (peer support)	5	2501	June 28, 2022
Replaced invalid timestamp value in message Graylog Central (peer support) pipeline-rules , time-stamp-issuespl	10	4227	March 23, 2022
Flexible data converter error Graylog Central (peer support)	2	487	April 26, 2019
Invalid format, date is malformed Graylog Central (peer support)	2	3385	July 2, 2019

Issues with date type converter format string

Related topics