Replace timestamp from another indexed field

[gsmith]

Hello @corporate_gadfly

@corporate_gadfly

Looks like I should use pipeline rule with set_field for timestamp field.

I would have to agree with you on the pipeline. Maybe something like this might help.

rule “ibm_datetime”
when
    true
then
    let new_date = parse_date(to_string($message.http_time), “yyyy-MM-dd’T’HH:mm:ss”, "CET,UTC,etc...");
    set_field(“timestamp”, new_date);
end

EDIT: I found this here.

Replacing default Graylog timestamp via Pipeline Processor

The following should do the trick rule “replace timestamp” when true then let new_date = parse_date(to_string($message.http_time), “yyyy-MM-dd’T’HH:mm:ss”, "CET"); set_field(“timestamp”, new_date); end You might want to add some debug information until it works like you expect. Something like you find in Can't overwrite timestamp through pipeline-rule

Hope that helps.