Modify timestamp

(Milen Vichev) #1


I’m using Graylog 2.4.5+8e18e6a.
I have difference between the timestamp columns shown in the stream. The one is the default timestamp column which I have configured to show correct time (+03:00h) in my user’s profile. The other one is the time of the message received. The second one is in UTC and I want it to be +03:00h.
The application server and the server on which the graylog is running are in the correct timezone. The application is sending the datetime in the correct format (ex: 2018-07-05T11:32:34.778+03:00).
I want this datetime to be correct as I am using it in the e-mail notifications.

I’ve read in the forum that this is a bug that hasn’t been fixed.

My question is:
Is there a way to modify the timestamp object somehow using extractors or something else to show the timestamp in my timezone in the email notification.
In the mail notification I’m using the ${message.timestamp} object.

Thank you

(Jochen) #2

The message timestamp is always stored with timezone UTC.