1. Describe your incident: After graylog upgrade to v4.2.6 we get these msgs: gl2_processing_error Replaced invalid timestamp value in message <2f44c541-98c8-11ec-88cc-1458d05629d8> with current time - Value <2022-02-28T18:56:50+00:00> caused exception: Invalid format: "2022-02-28T18:56:50+00:00" …

Hello @davama [image] davama: As a test I removed all the extractors and my msgs came in as so and with no gl2_processing_error Can I ask what type of input and extractor are you using? I’m assuming your using either Raw plaintext or JSON INPUT with a JSON extractor?

Thank you for the reply @gsmith Sorry i forgot to mention that. We are using syslog udp input with json extractor.

[image] davama: We are using syslog udp input with json extractor. By chance have you tested RawPlaintext Input? if so, did you get the same results?

@gsmith thank you for the input! using Raw/Plaintext UDP input without extractors i get below: message {"timestamp":"2022-03-02T00:25:00+00:00","source":"<redacted>","ip_address":"<redacted>","application_name":"00435","message":" ports: port C21 is Blocked by AAA","tag":"00435","level":"6","fa…

Hello @davama I believe since you sending this type of Date/time format. [image] davama: dateFormat="rfc3339" You need to convert the timestamp field to a proper timestamp using Pipeline or Extractor with a DATE converter. EXAMPLE: [image] Elasticsearch mapping expects a certain format…

@gsmith thank you for the input. it was very helpful I have never used pipelines before. Looks like they need to be linked to a stream, which I assume get processed before they are shipped to elastic. Is that right? Would not mind trying it but we have several streams and I think it will be easie…

@gsmith gave the extractor a shot but still no change… I’m sure I’m doing it wrong. My adjusted extractors with the Date format: { "extractors": [ { "title": "json_extractor", "extractor_type": "json", "converters": [], "order": 0, "cursor_strategy": "copy", …

Hello, [image] davama: Change my timestamp field to timestamp_temp in rsyslog [image] davama: timestamp_temp 2022-03-04 15:57:13.000 +00:00 Ah I see, So here is the scoop on that. Elasticsearch index template has a field called “timestamp”, the problem is trying to manipulate the “ti…

Replaced invalid timestamp value in message

Graylog Central (peer support)

davama (Dave) March 9, 2022, 4:44pm 10

Thank you @gsmith
Ill give this a retry and report back.

Topic		Replies	Views
Timestamp extractor error Graylog Central (peer support) pipeline-rules	1	1002	December 17, 2021
Error - Replaced invalid timestamp value in message Graylog Central (peer support)	3	1576	April 18, 2023
Replacing default Graylog timestamp via Pipeline Processor Graylog Central (peer support) pipeline-rules , debuggingpl	12	11615	March 11, 2019
Use Timestamp of logfiles Graylog Central (peer support)	3	4723	August 9, 2018
Failed to index [1] messages. failed to parse field [DateTime] of type [date] in document Graylog Central (peer support)	6	2345	July 26, 2022

Replaced invalid timestamp value in message

Related topics