# Set timestamp with pipeline

**URL:** <https://community.graylog.org/t/set-timestamp-with-pipeline/1713>\
**Category:** Graylog Central (peer support)\
**Created:** [July 12, 2017, 7:14pm UTC](https://community.graylog.org/t/set-timestamp-with-pipeline/1713 "2017-07-12T19:14:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![BradBooth](https://avatars.discourse-cdn.com/v4/letter/b/ccd318/32.png) [@BradBooth](https://community.graylog.org/u/BradBooth)\
**Post date:** [July 12, 2017, 7:14pm UTC](https://community.graylog.org/t/set-timestamp-with-pipeline/1713/1 "2017-07-12T19:14:32Z")

</div>

I’m having trouble setting the timestamp field of my logs with a different timestamp. I’ve seen the issue posted before here: [Searching imported logs by log timestamp, not time Graylog received the log - #4 by yett](https://community.graylog.org/t/searching-imported-logs-by-log-timestamp-not-time-graylog-received-the-log/233/4) but I can’t seem to get it to work.

Here is my current pipeline rule, I simply want to see if I am able to change the timestamp to a custom string (or date object).

> `rule "set timestamp" when true then let new_date = parse_date(to_string("2017-06-02T20:38:43.851Z"), "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"); set_field("timestamp", new_date); end`

If I set a custom field to the “new\_date” the format appears as follows:

> **Custom field**  
> 2017-06-02T20:38:43.851Z

But if I try to set the timestamp field, the log is dropped.  
My timestamp field has the following format:

> **timestamp**  
> 2017-07-12T19:09:48.010Z

Thanks

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [July 12, 2017, 11:37pm UTC](https://community.graylog.org/t/set-timestamp-with-pipeline/1713/2 "2017-07-12T23:37:11Z")

</div>

The date format string is wrong.

The `Z` shouldn’t be in quotes (because that is a literal “Z”) but be part of the format string, i. e. “yyyy-MM-dd’T’HH:mm:ss.SSSZ”), see [http://www.joda.org/joda-time/key\_format.html](http://www.joda.org/joda-time/key_format.html) for technical details.

---

<div class="post-metadata">

**Author:** ![BradBooth](https://avatars.discourse-cdn.com/v4/letter/b/ccd318/32.png) [@BradBooth](https://community.graylog.org/u/BradBooth)\
**Post date:** [July 13, 2017, 1:18am UTC](https://community.graylog.org/t/set-timestamp-with-pipeline/1713/3 "2017-07-13T01:18:15Z")

</div>

> [@BradBooth](#):
>
> let new\_date = parse\_date(to\_string(“2017-06-02T20:38:43.851Z”), “yyyy-MM-dd’T’HH:mm:ss.SSS’Z’”);

Ah you’re right, the Z should not have been in quotes.  
I’m still having some issues however, perhaps I’m not understanding how this should work.  
I’m trying to create a simple date object by using parse\_date.

> `let new_date = parse_date("2015", "yyyy");`

If I do this, then I can set a custom field using:

> `set_field("Custom Field", new_date); `

And it appears on the logs as follows:

> **Custom Field**  
> 2015-01-01T00:00:00.000Z

But if I do the same thing but for the timestamp field, the log is dropped and it doesn’t show in Graylog.

> `set_field("timestamp", new_date); `

Rule:

> rule “set timestamp”  
> when  
> true  
> then  
> let new\_date = parse\_date(“2015”, “yyyy”);  
> set\_field(“timestamp”, new\_date);  
> end

Is there maybe a more specific format that my date needs to be in?

Thanks again for your help.

---

<div class="post-metadata">

**Author:** ![BradBooth](https://avatars.discourse-cdn.com/v4/letter/b/ccd318/32.png) [@BradBooth](https://community.graylog.org/u/BradBooth)\
**Post date:** [July 13, 2017, 3:45pm UTC](https://community.graylog.org/t/set-timestamp-with-pipeline/1713/4 "2017-07-13T15:45:17Z")

</div>

Well this is embarrassing. The log wasn’t being dropped, I simply wasn’t searching in the right time frame. The timestamp was being changed.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 27, 2017, 3:45pm UTC](https://community.graylog.org/t/set-timestamp-with-pipeline/1713/5 "2017-07-27T15:45:23Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.