Hi Wayne, On Thursday, 13 October 2016 16:30:18 UTC+2, Wayne wrote: > > I understand that the timestamp reflects the time that graylog imported > the log messages, and not the timestamp associated with the application log > message. For example, if I send a log file from my application server to > graylog server, the timestamp of my application log message is a different > field (when extracted) in graylog UI >
Graylog is only falling-back to the ingestion time if the message itself doesn't include a timestamp or includes an invalid timestamp. For example if you're using a GELF input and the GELF messages contain a valid timestamp field, that timestamp is being used as message timestamp in Graylog. Is there a workaround? > What exactly is the problem you're trying to solve? Cheers, Jochen -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/f3b1331d-8b10-4e7a-97c4-157e7193ab53%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
