Pipeline parsing and setting correct timestamp

Graylog Central (peer support)
5

I use this pipeline

rule “parse event timestamp”
when
true
then
set_field(“timestamp”,parse_date(to_string($message.test),“yyyy-MM-dd’T’hh:mm:ss.SSSZ”));
end

And extractor with name test from this message

2017-05-22T03:10:16+00:00 itc2000 daemon info itcTransceiver[1320]: SBCWorkflow: now 1970-Jan-03 17:50:18.831346 (0.-247636)

and I got extracted timestamp from message → test: 2017-05-22T03:10:16.000Z

Then with pipeline want to replace timeline with this data from test extractor.

1 Like