# Struggling With Timestamp conversion

**URL:** <https://community.graylog.org/t/struggling-with-timestamp-conversion/33304>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules, timestamp\
**Created:** [August 22, 2024, 7:03pm UTC](https://community.graylog.org/t/struggling-with-timestamp-conversion/33304 "2024-08-22T19:03:50Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![EyImWawkinHeah](https://avatars.discourse-cdn.com/v4/letter/e/74df32/32.png) [@EyImWawkinHeah](https://community.graylog.org/u/EyImWawkinHeah)\
**Post date:** [August 22, 2024, 7:03pm UTC](https://community.graylog.org/t/struggling-with-timestamp-conversion/33304/1 "2024-08-22T19:03:50Z")

</div>

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.  
**Don’t forget to select tags to help index your topic!**

**1. Describe your incident:**  
We are receiving processing errors for 2 different log sources relating to timestamps.

Failure Details Example:  
Value \<2024-08-22T17:55:22.875418Z\> caused exception: Invalid format: “2024-08-22T17:55:22.875418Z” is malformed at “T17:55:22.875418Z”.

**2. Describe your environment:**  
2 node cluster in Graylog Cloud of 6.0.4

**3. What steps have you already taken to try and solve the problem?**  
I have attempted to do research onto how other people have solved this issue.  
I found pipeline rules extracting/parsing the timestamp to be the solution for most people but its just not working for me.

Here is the current pipeline rule I am trying out, doesn’t seem to work:

```auto
rule "testing timestamps"
when
   true
then
    let result = regex("([0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3})",to_string($message.message));    
    let new_date = parse_date(to_string(result["0"]), "yyyy-MM-dd'T'HH:mm:ss.SSS","EST");
    set_field("timestamp", new_date);
end

```

This doesn’t appear to set the new date correctly:  
 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/0/2/02f8aac9bb1cd0406eeecb50dbf9833f1e5ec051.png)

The regex appears to be good.  
I have also played around with the date format in new\_date trying different variations. Where am I going wrong? For what its worth, I’m pretty new to pipeline rules so it might be painfully obvious what I’m doing wrong to you guys.

**4. How can the community help?**  
Looking for a bit of guidance on next steps.

---

<div class="post-metadata">

**Author:** ![EyImWawkinHeah](https://avatars.discourse-cdn.com/v4/letter/e/74df32/32.png) [@EyImWawkinHeah](https://community.graylog.org/u/EyImWawkinHeah)\
**Post date:** [August 22, 2024, 8:53pm UTC](https://community.graylog.org/t/struggling-with-timestamp-conversion/33304/2 "2024-08-22T20:53:14Z")

</div>

I think I found something that works.

```auto
rule "Fix Timestamp"
when
   has_field("timestamp")
then
    let result = regex("([0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3})",to_string($message.timestamp));
    let new_date = parse_date(to_string(result["0"]), "yyyy-MM-dd'T'HH:mm:ss.SSS", "America/Toronto");
    set_field("timestamp", new_date);
end

```

I swear I had already tried this but guess not…

Gonna let it soak over night.

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [August 22, 2024, 9:58pm UTC](https://community.graylog.org/t/struggling-with-timestamp-conversion/33304/3 "2024-08-22T21:58:58Z")

</div>

hey @EyImWawkinHeah

If that doesn’t work, try setting the field “timestamp” to “timestamp1”.

---

<div class="post-metadata">

**Author:** ![EyImWawkinHeah](https://avatars.discourse-cdn.com/v4/letter/e/74df32/32.png) [@EyImWawkinHeah](https://community.graylog.org/u/EyImWawkinHeah)\
**Post date:** [August 23, 2024, 5:36pm UTC](https://community.graylog.org/t/struggling-with-timestamp-conversion/33304/4 "2024-08-23T17:36:06Z")

</div>

That’s essentially how I found out my stuff wasn’t working, thanks for the response!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [September 6, 2024, 5:36pm UTC](https://community.graylog.org/t/struggling-with-timestamp-conversion/33304/5 "2024-09-06T17:36:52Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.