Hi Jochen, It is tricky.
Now I found out the extractor to overwrite the timestamp actually stopped the messages to come to graylog server. Once I delete it or rename the "store as field" to names other than timestamp, the messages come into graylog server again, but then I could not overwrite the timestamp field. I remember there was a brief time I was able to overwrite the field, but with a different timezone. However, I could not overwrite it at all now. What could be some common reasons that prevent messages to come into graylog if the timestamp field is overwritten? Thanks, Wayne On Monday, October 17, 2016 at 2:25:53 AM UTC-4, Jochen Schalanda wrote: > > Hi Wayne > > On Friday, 14 October 2016 19:36:17 UTC+2, Wayne wrote: >> >> I have tried your extractor, and it looks like it almost worked, except >> that the timestamp seems to use UTC, instead of my local time zone. >> > > The date converter can be configured to use a specific timezone. > > Cheers, > Jochen > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/b75427ee-f04f-4016-b44a-721952b270c3%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
