Timestamp change pipeline

Graylog Central (peer support)
1

Hi,

I want to change the time of my logs timestamp by reducing 3 hours from it timestamp.

rule "set timestamp"
when
  $message.source == "example.org"
then
  let new_timestamp = parse_date(to_string($message.timestamp), "yyyy-MM-dd HH:mm:ss");
  ***new_timestamp = new_timestamp-3;***
  set_field("timestamp", new_timestamp);
end

The starred line is not correct. How can I fix it?

2

Hello,

Have you seen this.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.