Replacing default Graylog timestamp via Pipeline Processor

Graylog Central (peer support)
,
10

The following should do the trick

rule “replace timestamp”
when
    true
then
    let new_date = parse_date(to_string($message.http_time), “yyyy-MM-dd’T’HH:mm:ss”, "CET");
    set_field(“timestamp”, new_date);
end

You might want to add some debug information until it works like you expect. Something like you find in Can't overwrite timestamp through pipeline-rule