Graylog2 / Graylog2/graylog2-server
date object not saved identically if in "timestamp" or "another_field"
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Trying to overide the default timestamp in a pipeline.
1 - Getting all info from JSON (ok)
2 - Creating fields (ok)
3 - Trying to get exact timestamp from json & replacing it in message.
Issues :
- **Saving date (from parse_date) to timestamp does NOT work (fails)**
- Saving date or to_string(date) to "new fields" works as expected (right value)
- Saving date (through to_string) to "timestamp" (system field) gives wrong ms in user interface
```
rule "Remove header, explode json to fields if Ignition"
when
contains( to_string($message.source), "cli-lap-aiz-master-ign", true)
AND
contains( to_string($message.message), "\"ignition\"", true)
then
// Get right part after the space
let rm = split(" ", to_string($message.message),2);
// Replace message (remove the cli-xxx-yyy-.... )
let jsonstr = to_string(rm[1]);
set_field("message",jsonstr);
// Get sub-Json field & map in message
let json = parse_json(jsonstr);
let map = to_map(json);
set_fields(map,"j");
// Replace timestamp
// example 2020-07-16 21:31:03,746
let newDateStr = to_string($message.jtimestamp)+"Z";
// example 2020-07-16 21:31:03,746Z
let newDateStr = replace( newDateStr,",",".");
// example 2020-07-16 21:31:03.746Z
let newDateStr = replace( newDateStr," ","T");
// example 2020-07-16T21:31:03.746Z
//set_field("toto",newDateStr);
let new_date = parse_date(newDateStr,"yyyy-MM-dd'T'HH:mm:ss.SSSZ");
set_field("timestamp", to_string(new_date) );
set_field("timestamp_date", new_date );
set_field("timestamp_to_string", to_string(new_date) );
end
```
**Example** :
- original js = 2020-07-16 23:11:04,020 (REFERENCE)
- timestamp_date = 2020-07-16T21:11:04.020Z (OK)
- timestamp_to_string = 2020-07-16T21:11:04.020Z (OK)
- timestamp = 2020-07-16T21:11:05.205Z (PROBLEM)
There is something like 400ms to 1.5s difference following moments...
Any idea ?
Contributor guide
Assessment
This issue has not been assessed yet.