Graylog2 / Graylog2/graylog2-server

date object not saved identically if in "timestamp" or "another_field"

Open
#8,568 1 comment 1 reaction 1 assignee Claimed by @kroepke View on GitHub
to-verify
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Trying to overide the default timestamp in a pipeline.

1 - Getting all info from JSON (ok)
2 - Creating fields (ok)
3 - Trying to get exact timestamp from json & replacing it in message.

Issues :
- **Saving date (from parse_date) to timestamp does NOT work (fails)**
- Saving date or to_string(date) to "new fields" works as expected (right value)
- Saving date (through to_string) to "timestamp" (system field) gives wrong ms in user interface

```
rule "Remove header, explode json to fields if Ignition"

when
contains( to_string($message.source), "cli-lap-aiz-master-ign", true)
AND
contains( to_string($message.message), "\"ignition\"", true)
then
// Get right part after the space
let rm = split(" ", to_string($message.message),2);

// Replace message (remove the cli-xxx-yyy-.... )
let jsonstr = to_string(rm[1]);
set_field("message",jsonstr);

// Get sub-Json field & map in message
let json = parse_json(jsonstr);
let map = to_map(json);
set_fields(map,"j");

// Replace timestamp
// example 2020-07-16 21:31:03,746

let newDateStr = to_string($message.jtimestamp)+"Z";
// example 2020-07-16 21:31:03,746Z

let newDateStr = replace( newDateStr,",",".");
// example 2020-07-16 21:31:03.746Z

let newDateStr = replace( newDateStr," ","T");
// example 2020-07-16T21:31:03.746Z

//set_field("toto",newDateStr);
let new_date = parse_date(newDateStr,"yyyy-MM-dd'T'HH:mm:ss.SSSZ");
set_field("timestamp", to_string(new_date) );
set_field("timestamp_date", new_date );
set_field("timestamp_to_string", to_string(new_date) );
end
```

**Example** :
- original js = 2020-07-16 23:11:04,020 (REFERENCE)
- timestamp_date = 2020-07-16T21:11:04.020Z (OK)
- timestamp_to_string = 2020-07-16T21:11:04.020Z (OK)
- timestamp = 2020-07-16T21:11:05.205Z (PROBLEM)
There is something like 400ms to 1.5s difference following moments...

Any idea ?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.