Timestamp extractor not working 0 hits, 44 misses

I am trying to fix timestamp on my logs that are set 7 hrs backwards in time. It is not working, not sure why.


  • regex: ^(\d{4}-\d{2}-\d{2})\S(\d{2}:\d{2}:\d{2}.\d{3}).$
  • replacement: $1 $2
  • replace_all:


  • date
    • date_format: yyyy-MM-dd HH:mm:ss.SSS
    • time_zone: America/Vancouver
    • locale:

did you checked the documentation on that?: http://docs.graylog.org/en/2.4/pages/extractors.html#the-standard-date-converter

copy input extractor doesn’t work either. all misses

Is my format string right?
Message: 2018-10-18T03:49:32.000Z
Format String: yyyy-MM-dd HH:mm:ss.SSS

Ended up not needing this. I am now sending logs to syslog-ng server that fixes the date and other stuff and forwards the logs graylog

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.