Timestamp can't be replaced

when I want to use pipeline to change the original one, then I can’t receive my logs.

rule “change_timezone”
when
has_field(“timestamp”)
then
let result = regex(“^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3})”, to_string($message.timestamp));
let ori_date = parse_date(to_string(result[“0”]), “yyyy-MM-dd’T’HH:mm:ss.SSS”);
let now_date = parse_date(to_string(result[“0”]), “yyyy-MM-dd’T’HH:mm:ss.SSS”, “en_US”, “Asia/Qatar”);
set_field(“ori_date”, ori_date);
set_field(“timestamp”, now_date);
end

If I write like this, I won’t see any new logs in my dashboard any more.
If I change the field timestamp to another new field. For example like set_field(“new_date”, new_date);
I can see the new logs, but the timestamp can’t be changed.

Today I logged in to my graylog server again, and everything worked just fine.
It’s so weird, I really tried a lot of times yesterday.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.