Parse_date() returns January

[clxnetom]

So I have been going through the forums and while I found two related topics (GROK-Date-Parser always parses to January and Odd search behaviour (time related)) I do not find a solution in neither of them.

For troubleshooting purposes micro or milliseconds are needed in the timestamp. I have a field to parse for that but the month gets changes from (currently) May to January whenever I try to use the field as the date.

So a field looking like this

LogEntryTimestamp: 2020-05-29 05:16:40.585983

going through a pipeline like this

let new_date = parse_date(to_string($message.LogEntryTimestamp), “yyyy-MM-DD HH:mm:ss.SSSSSS”);
set_field(“timestamp”, new_date);

ends up looking like this

timestamp: 2020-01-29 05:19:12 +00:00

Any help would be greatly appreciated.

[MajesticCo (James)]

Hey,

Try using this instead:
let new_date = parse_date(to_string($message.LogEntryTimestamp), “yyyy-MM-dd HH:mm:ss.SSSSSS”);

The capital D is “day of year” and d is “day of month” according to the documentation so I guess that is your issue here, but I can’t test it at the moment. https://docs.graylog.org/en/3.2/pages/pipelines/functions.html#parse-date

[clxnetom]

Do I feel stupid?

Worked like a charm. Big thanks!

Not sure how many times I read the documentation without realizing that.