Timestamp without fraction of seconds not accepted

I’m collecting messages with the GCP plugin

this plugin parse the timestamp with rule

        // Timestamp.
        JsonNode value = node.path("timestamp");
        if (value.isTextual()) {
          timestamp = ISODateTimeFormat.dateTime().withZone(DateTimeZone.UTC).parseDateTime(value.asText());

Messages with timestamp in the format of
“timestamp”:“2020-12-31T08:24:35.647524111Z” works well
while format
“timestamp”:“2020-12-31T10:53:41Z” fails

The failure is with messages (graylog’s log) like:

java.lang.IllegalArgumentException: Invalid format: "2021-01-19T09:44:12Z" is malformed at "Z"
at org.joda.time.format.DateTimeFormatter.parseDateTime(DateTimeFormatter.java:945) ~[graylog.jar:?]

I’m trying to use pipelines and/or extractors using hints in documentations and many topics on the forum but it doesn’t work. I’m suspecting it’s not possible to do it on this way as the piplines/extractors works with messages accepted by graylog and in my case it’s revoked and the messages are not present on the UI.
Could someone confirm my surmise and/or advice how to resolve this issue?

btw. some messages from the same source has the timestamp with fraction of seconds filled so they are on visible on UI.

pipeline used
rule “add SSS to timestamp”
// the following date format assumes there’s no time zone in the string
let new_date = parse_date(to_string($message.timespamp), “yyyy-MM-dd HH:mm:ss.SSS”);
set_field(“timestamp-new”, new_date);


This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.