I’m having trouble setting the timestamp field of my logs with a different timestamp. I’ve seen the issue posted before here: Searching imported logs by log timestamp, not time Graylog received the log but I can’t seem to get it to work.
Here is my current pipeline rule, I simply want to see if I am able to change the timestamp to a custom string (or date object).
rule "set timestamp" when true then let new_date = parse_date(to_string("2017-06-02T20:38:43.851Z"), "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"); set_field("timestamp", new_date); end
If I set a custom field to the “new_date” the format appears as follows:
But if I try to set the timestamp field, the log is dropped.
My timestamp field has the following format: