I need to extract just the date (YYYY-MM-DD), but I am unable to get any extractors to run against the “timestamp” field. I’ve also tried using “copy input” to copy to a new field and then extract on that field, but “copy input” doesn’t work either. See screenshot for my extractor configuration.
You might want to use a pipeline and the format_date function
https://docs.graylog.org/en/3.3/pages/pipelines/functions.html#format-date