# Searching imported logs by log timestamp, not time Graylog received the log

**URL:** <https://community.graylog.org/t/searching-imported-logs-by-log-timestamp-not-time-graylog-received-the-log/233>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules, dump-messagespl\
**Created:** [February 24, 2017, 8:00pm UTC](https://community.graylog.org/t/searching-imported-logs-by-log-timestamp-not-time-graylog-received-the-log/233 "2017-02-24T20:00:06Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![yett](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/yett/32/74_2.png) [@yett](https://community.graylog.org/u/yett)\
**Post date:** [February 25, 2017, 2:31pm UTC](https://community.graylog.org/t/searching-imported-logs-by-log-timestamp-not-time-graylog-received-the-log/233/4 "2017-02-25T14:31:32Z")

</div>

Some example based on @lennart’s comment.

I struggled 4 hours just to figure that out. 😃 Hope this will save some time for others.

E.g.

1. I stored event timesamp value in `event_ts`, from apache combined log. I extracted with Grok.
2. Processing pipeline to parse the values I groked and and store it in `timestamp` value.

Following is example rules for the example.

```
rule "parse event timestamp"
when
    true
then
    let new_date = parse_date(to_string($message.event_ts), "dd/MMM/yyyy:hh:mm:ss Z");   
    set_field("timestamp", new_date);    
end

```

I would like to know my approach is proper? or if there is better way to achieve it.

Cheers,

ye

---

_[View the full topic](https://community.graylog.org/t/searching-imported-logs-by-log-timestamp-not-time-graylog-received-the-log/233)._