Match Message Against a timestamp RegEx

[shoothub]

Your pipeline rule have some problems:

1. You use wrong $message definition, try use to_string($message.message)
2. You need to use index or name or group to point to regex result.

• Replace line:
  let new_date = parse_date(result, "yyyy-MM-dd'T'HH:mm:ss","IST");
• with:
  let new_date = parse_date(result["0"], "yyyy-MM-dd'T'HH:mm:ss","IST");
  Functions — Graylog 4.1.0 documentation

3. Your format in parse_date function missing milliseconds
   Functions — Graylog 4.1.0 documentation

So try this one:

rule "replace timestamp"
when
    true
then
    let result = regex("([0-9-T.:]+)", to_string($message.message));
    let new_date = parse_date(to_string(result["0"]), "yyyy-MM-dd'T'HH:mm:ss.SSS","IST");
    set_field("timestamp", new_date);
end