# Replace Timestamp with extracted timestamp issue

**URL:** <https://community.graylog.org/t/replace-timestamp-with-extracted-timestamp-issue/24664>\
**Category:** Graylog Central (peer support)\
**Tags:** timestamp\
**Created:** [July 6, 2022, 10:56pm UTC](https://community.graylog.org/t/replace-timestamp-with-extracted-timestamp-issue/24664 "2022-07-06T22:56:59Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![ogudino](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ogudino/32/12310_2.png) [@ogudino](https://community.graylog.org/u/ogudino)\
**Post date:** [July 6, 2022, 10:56pm UTC](https://community.graylog.org/t/replace-timestamp-with-extracted-timestamp-issue/24664/1 "2022-07-06T22:56:59Z")

</div>

Trying to replace the timestamp received from filebeat with the timestamp from some old logs.  
I created a extractor with just dd-MM-yyyy hh:mm:ss.S transform to date and put as field name timestamp as I found in some blogs, but did not works is still using graylog timestamp. The difference is that Graylog timestamp format is different that my timestamps logs format

Graylog Server timestamp format is yyyy-MM-dd hh:mm:ss.S  
My Logs Format is: dd-MM-yyyy hh:mm:ss.S

I am using Ubuntu 20.04 with graylog 4.3.2

And filebeat to send the logs to the graylog server and my logs are some jboss logs.  
This is an example of my log timestamp:  
22/05/2022 09:24:19.727

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/fff463954c22ee458d726958dd3d941c743681a7.png)

**Helpful Posting Tips:** [Tips for Posting Questions that Get Answers](https://community.graylog.org/t/tips-for-posting-questions-that-get-answers/21828) [Hold down CTRL and link on link to open tips documents in a separate tab]

---

<div class="post-metadata">

**Author:** ![ogudino](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ogudino/32/12310_2.png) [@ogudino](https://community.graylog.org/u/ogudino)\
**Post date:** [July 6, 2022, 11:28pm UTC](https://community.graylog.org/t/replace-timestamp-with-extracted-timestamp-issue/24664/2 "2022-07-06T23:28:19Z")

</div>

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/e/e680a3338cd1a656a3613bd0e08522d04e7ad974.png)

---

<div class="post-metadata">

**Author:** ![ogudino](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ogudino/32/12310_2.png) [@ogudino](https://community.graylog.org/u/ogudino)\
**Post date:** [July 6, 2022, 11:28pm UTC](https://community.graylog.org/t/replace-timestamp-with-extracted-timestamp-issue/24664/3 "2022-07-06T23:28:31Z")

</div>

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/c/c99ea749948858ad8e6e9db7f03c7b6455801474.png)

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [July 7, 2022, 1:49am UTC](https://community.graylog.org/t/replace-timestamp-with-extracted-timestamp-issue/24664/4 "2022-07-07T01:49:26Z")

</div>

Hello && Welcome @ogudino  
Maybe try this

```auto
rule "replace timestamp"
when
    true
then
    let result = regex("([0-9-T.:]+)", to_string($message.Testing));
    let new_date = parse_date(to_string(result["0"]), "yyyy-MM-dd'T'HH:mm:ss.SSS","CST"); ///Centeral time Zone
    set_field("timestamp", new_date);
end

```

EDIT:  
For pipelines, insure the following is correct under _System/Configuration_ → Message Processors Configuration. make sure Pipeline processor is after Message Filter Chain.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/b/b415bd90b1438867de761744f16cf61e4fda10de.png)

---

<div class="post-metadata">

**Author:** ![ogudino](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ogudino/32/12310_2.png) [@ogudino](https://community.graylog.org/u/ogudino)\
**Post date:** [July 7, 2022, 5:27pm UTC](https://community.graylog.org/t/replace-timestamp-with-extracted-timestamp-issue/24664/5 "2022-07-07T17:27:16Z")

</div>

> [@gsmith](#):
>
> ```auto
> 
> ```
> 
> EDIT:

Hi thanks for your answer  
I detect some error in my extractor, because my original field is like day/month/year… and as the Timestamp is using - instead of /, I use the replace with regular expression to do the change and then convert to date field:

2022-07-07T20:20:17.176+03:00 ERROR [Extractor] Could not apply converter [DATE] of extractor \<Testing (bdfb51f0-fe17-11ec-85e2-02423c9a532d)\>:  
java.lang.IllegalArgumentException: Invalid format: “18-05-2022 10:05:07.648” is malformed at “-05-2022 10:05:07.648”  
at org.joda.time.format.DateTimeFormatter.parseDateTime(DateTimeFormatter.java:945)  
… 13 more

#### 

My extractor setting

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/a/a06ca7a4012435d7975456c2cec89326f2e05873.png)

---

<div class="post-metadata">

**Author:** ![ogudino](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ogudino/32/12310_2.png) [@ogudino](https://community.graylog.org/u/ogudino)\
**Post date:** [July 7, 2022, 6:01pm UTC](https://community.graylog.org/t/replace-timestamp-with-extracted-timestamp-issue/24664/6 "2022-07-07T18:01:59Z")

</div>

Issue solved using the following post → [Issues with date type converter format string - Graylog Central - Graylog Community](https://community.graylog.org/t/issues-with-date-type-converter-format-string/21524/12)

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 21, 2022, 6:02pm UTC](https://community.graylog.org/t/replace-timestamp-with-extracted-timestamp-issue/24664/7 "2022-07-21T18:02:05Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.