# Log timestamp vs graylog one

**URL:** <https://community.graylog.org/t/log-timestamp-vs-graylog-one/25860>\
**Category:** Graylog Central (peer support)\
**Created:** [September 22, 2022, 10:45am UTC](https://community.graylog.org/t/log-timestamp-vs-graylog-one/25860 "2022-09-22T10:45:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gianluca-valentini](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gianluca-valentini/32/1592_2.png) [@gianluca-valentini](https://community.graylog.org/u/gianluca-valentini)\
**Post date:** [September 22, 2022, 10:45am UTC](https://community.graylog.org/t/log-timestamp-vs-graylog-one/25860/1 "2022-09-22T10:45:54Z")

</div>

Hi,  
my application log send json with timestamp key . How I can distinguish between the log one and the graylog ingestion timestamp?

I tried to add an extractor but it seems that the only timestamp that I can get is the graylog one  
Is possible to change the graylog timestamp key?

---

<div class="post-metadata">

**Author:** ![Arie](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/arie/32/8094_2.png) [@Arie](https://community.graylog.org/u/Arie)\
**Post date:** [September 22, 2022, 3:28pm UTC](https://community.graylog.org/t/log-timestamp-vs-graylog-one/25860/2 "2022-09-22T15:28:40Z")

</div>

We do something you might need with a grok pattern, the timestamp is put into the graylog timestamp field, in our case the timestamp matches the graylog one:

```auto
rule "Parse - messages"
when
    // Use routing message to select messages
    to_string($message.message_route) == "logging_route"
then
let pf = grok(
    pattern: "%{TIMESTAMP_ISO8601:timestamp} %{INT:UNWANTED} *%{WORD:app_loglevel} %{NOTSPACE:app_thread} %{WORD:app_threadname} -%{GREEDYDATA:app_statusmessage}",
    value: to_string($message.message),
    only_named_captures: true
);
set_fields(pf);
// Add Parse field for easier message tracing
set_field("parse","Parse - app_logging");
end

```

Good luck.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [October 6, 2022, 3:29pm UTC](https://community.graylog.org/t/log-timestamp-vs-graylog-one/25860/3 "2022-10-06T15:29:11Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.