# Parse timestamp to graylog **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [August 9, 2017, 10:43am UTC](https://community.graylog.org/t/parse-timestamp-to-graylog/2019 "2017-08-09T10:43:58Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![hun](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/hun/32/2207_2.png) [@hun](https://community.graylog.org/u/hun)\ **Post date:** [August 9, 2017, 10:43am UTC](https://community.graylog.org/t/parse-timestamp-to-graylog/2019/1 "2017-08-09T10:43:58Z")
I am trying to upload a log file which has json format using nc. I am interested in reading the timestamp from the log file rather than the time stamp of the upload itself. I even created an extractor as mentioned in the docs, but I still get the timestamp of the upload. Please find an example. ![41](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/1X/5c4b03587611d2cb5a96ab9abf6faaa53a895812.png) ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [August 9, 2017, 11:56am UTC](https://community.graylog.org/t/parse-timestamp-to-graylog/2019/2 "2017-08-09T11:56:09Z")
“Timestamp” and “timestamp” are two different fields. Graylog is using the lower case “timestamp” field as canonical message timestamp. ---
**Author:** ![hun](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/hun/32/2207_2.png) [@hun](https://community.graylog.org/u/hun)\ **Post date:** [August 9, 2017, 12:03pm UTC](https://community.graylog.org/t/parse-timestamp-to-graylog/2019/3 "2017-08-09T12:03:45Z")
Can you please provide an example to overwrite the graylog Timestamp with my Timestamp from the uploaded logs? ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [August 9, 2017, 12:12pm UTC](https://community.graylog.org/t/parse-timestamp-to-graylog/2019/4 "2017-08-09T12:12:23Z")
Please refer to the documentation of the [`set_field()`](http://docs.graylog.org/en/2.3/pages/pipelines/functions.html#set-field) pipeline function. ---
**Author:** ![mgagliardi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mgagliardi/32/657_2.png) [@mgagliardi](https://community.graylog.org/u/mgagliardi)\ **Post date:** [August 9, 2017, 12:13pm UTC](https://community.graylog.org/t/parse-timestamp-to-graylog/2019/5 "2017-08-09T12:13:57Z")
Without a representative event or two from your logfile it’s difficult to provide an exact example. But generally speaking here’s what you’re going to do: - Create an extractor for the input that ingests your logfile - Use a regex, a GROK expression, etc. to digest the portion of your input (often the message field) that contains the timestamp - Store the parsed-out data as field timestamp (think of this as overwriting the Graylog-generated timestamp). - Add a converter if necessary to format the extracted string in the correct manner. FWIW I’m pretty new to Graylog as well and found the documentation for this kind of thing pretty straightforward. And I see that jochen just replied advising you check out the pipeline functionality, which long-term is definitely the “right” advice as I believe extractors are kind of the past and pipeline is the future. ---
**Author:** ![hun](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/hun/32/2207_2.png) [@hun](https://community.graylog.org/u/hun)\ **Post date:** [August 9, 2017, 2:29pm UTC](https://community.graylog.org/t/parse-timestamp-to-graylog/2019/6 "2017-08-09T14:29:20Z")
Hey Matt, I tried both methods, still not working and I am not able to figure out what I am doing wrong! ![01](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/1X/dc6a552f3a6c1cdf07468f9dabc495a2d2f4010c.png) ![59](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/1X/11663ea7d06cb2c2a3bc6130ab15fb99d7fe0eda.png) The json file is getting parsed correctly, but not able to overwrite the timestamp. Any hint would be much appreciated. ---
**Author:** ![hun](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/hun/32/2207_2.png) [@hun](https://community.graylog.org/u/hun)\ **Post date:** [August 9, 2017, 3:27pm UTC](https://community.graylog.org/t/parse-timestamp-to-graylog/2019/7 "2017-08-09T15:27:37Z")
I was able to get the pipeline to work as I checked it through simulation processing ![25](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/1X/cd5105330b6218464452677a72ac6806903210f3.png) still not seeing any changes when I search for 30 days ---
**Author:** ![mgagliardi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mgagliardi/32/657_2.png) [@mgagliardi](https://community.graylog.org/u/mgagliardi)\ **Post date:** [August 9, 2017, 6:47pm UTC](https://community.graylog.org/t/parse-timestamp-to-graylog/2019/8 "2017-08-09T18:47:51Z")
FWIW I don’t think you’d want to _cut_ (in that first example), you’d want to _copy_ into “timestamp” (low case). That should overwrite the Graylog-provided timestamp with the one you parsed out. Also, don’t forget the time zone or your entries may end up in the future/past. I can’t speak to the pipeline example as I’ve not gone there yet. But do remember that the extractor (or pipeline I’d guess) is not able to go back to info that’s already been indexed. You should narrow your search criteria to the period after you make changes to the extractor/pipeline to see if it’s now doing what you want. You may even have to force the current index to roll. ---
**Author:** ![hun](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/hun/32/2207_2.png) [@hun](https://community.graylog.org/u/hun)\ **Post date:** [August 11, 2017, 12:24pm UTC](https://community.graylog.org/t/parse-timestamp-to-graylog/2019/9 "2017-08-11T12:24:53Z")
Thanks a lot Matt! It’s now working using pipeline ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [August 25, 2017, 12:25pm UTC](https://community.graylog.org/t/parse-timestamp-to-graylog/2019/10 "2017-08-25T12:25:10Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.