Update Timestamp with Timestamp in logs

[Arthur]

Hi,

Thanks for your help in this question. I would like to change the Timestamp in Graylog to provide the Timestamp coming from the logs collected by filebeat. In order to achieve this, I have created an extractor using regular expression and saved it as a field “Timestamp” as follows:

The problem is that in Graylog search I have an inconsistency of Timestamp and timestamp fields. The current timestamp which corresponds to the time the log was processed is in Timestamp and timestamp field and I have another Timestamp field which has the time related to the log. To clarify the scenario I provide an screenshot of the mentioned behaviour:

Can you please help to clarify this behaviour? and indicate how to fix this?

Thanks a lot, I appreciate your help.

[jan (Jan Doberstein)]

the fieldnames are casesensitive.so use lowercase timestamp and all is fine.

[Arthur]

Thanks for your answer Jan, I have changed to lowercase using timestamp, but the Search keeps the previous Timestamp field and the new field timestamp keeps the same time. Please let me show you in this example:

Changed to lowercase the field as follows:

How can I replace the timestamp with the one coming in the logs?

Thanks again

[Arthur]

One thing that got my attention is this statement: " Trying to extract data from message into timestamp , leaving the original intact."

I added Date as converter, but did not help to get the real timestamp.

Thanks

[jan (Jan Doberstein)]

that the T in the first timestamp is capitalized is a mistake, because it gives you a wrong meaning.

The first timestamp is always shown in the timezone that your userprofil has selected. The second timestamp is how the timestamp is saved in Elasticsearch, including the timezone.

The extract of timestamp does not work because it needs to be in a spezific format - and not in the format you extract.

You can do that with a converter in the same extractor.

[Arthur]

Thanks for your help and guidance Jan.

Finally I got the timestamp changed with the same time than the logs. The converter was configured as follows:

Thanks a lot