Hi Jochen,

I tried again. It looks like the timezone field needs to be filled in. if 
left blank, no messages will be shipped to graylog server.

However, I tried "Toronto", "GMT+4". Both did not fix the timezone issue 
with timestamp having correct minutes/seconds/milliseconds, but not hours. 
When I use "GMT-4", messages did not get shipped in.

For example, the best case is like:

The converted timestamp: 2016-10-18 15:01:34.559
and the real timestamp from application log is: 2016-10-18 11:01:34:559

There is a four hour difference (when the timezone is configured as either 
"Toronto" or "GMT+4"

What is correct timezone setting that can fix this issue?



On Tuesday, October 18, 2016 at 10:35:58 AM UTC-4, Wayne wrote:
> Hi Jochen,
> It is tricky.
> Now I found out the extractor to overwrite the timestamp actually stopped 
> the messages to come to graylog server. Once I delete it or rename the 
> "store as field" to names other than timestamp, the messages come into 
> graylog server again, but then I could not overwrite the timestamp field.
> I remember there was a brief time I was able to overwrite the field, but 
> with a different timezone. However, I could not overwrite it at all now.
> What could be some common reasons that prevent messages to come into 
> graylog if the timestamp field is overwritten?
> Thanks,
> Wayne
> On Monday, October 17, 2016 at 2:25:53 AM UTC-4, Jochen Schalanda wrote:
>> Hi Wayne
>> On Friday, 14 October 2016 19:36:17 UTC+2, Wayne wrote:
>>> I have tried your extractor, and it looks like it almost worked, except 
>>> that the timestamp seems to use UTC, instead of my local time zone.
>> The date converter can be configured to use a specific timezone.
>> Cheers,
>> Jochen

You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
For more options, visit https://groups.google.com/d/optout.

Reply via email to