when I want to use pipeline to change the original one, then I can’t receive my logs.
rule “change_timezone”
when
has_field(“timestamp”)
then
let result = regex(“^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3})”, to_string($message.timestamp));
let ori_date = parse_date(to_string(result[“0”]), “yyyy-MM-dd’T’HH:mm:ss.SSS”);
let now_date = parse_date(to_string(result[“0”]), “yyyy-MM-dd’T’HH:mm:ss.SSS”, “en_US”, “Asia/Qatar”);
set_field(“ori_date”, ori_date);
set_field(“timestamp”, now_date);
end
If I write like this, I won’t see any new logs in my dashboard any more.
If I change the field timestamp to another new field. For example like set_field(“new_date”, new_date);
I can see the new logs, but the timestamp can’t be changed.