title: Extract timestamp from message with Graylog extractor
body: <h2>Background</h2>
  <p>I am trying to override the default timestamp Graylog assigns messages with the one written in the message itself.</p>
  <p>To achieve this I read the official docs:</p>
  <p><a href="https://docs.graylog.org/en/3.3/pages/extractors.html#the-standard-date-converter" rel="nofollow noreferrer">https://docs.graylog.org/en/3.3/pages/extractors.html#the-standard-date-converter</a></p>
  <p>However I am still unable to correctly set the timestamps.</p>
  <h2>Messages</h2>
  <p>Most of messages start like the following:</p>
  <blockquote>
  <p>2021-02-14T06:07:58.521009+00:00 myApp00_rest_of_log</p>
  </blockquote>
  <p>There are other types of messages that don't adhere to this standard, but that is for latter.</p>
  <p>To extract the timestamp from the message I have created the following extractor:</p>
  <p><a href="https://i.stack.imgur.com/gVuQE.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/gVuQE.png" alt="extractor_screenshot" /></a></p>
  <p>The RegEx does it's job nicely, however it's the converter that's killing it.</p>
  <h2>Problem</h2>
  <p>As you can see I am using the converter:</p>
  <p><code>yyyy-MM-ddTHH:mm:ss.S</code></p>
  <p>This doesn't work. I have also tried the following variations:</p>
  <pre><code>yyyy-MM-dd'T'HH:mm:ss.S
  yyyy-MM-dd HH:mm:ss.S
  yyyy-MM-dd'T'HH:mm:ss.SSSSSS
  yyyy-MM-dd HH:mm:ss.SSSSSS
  yyyy-MM-ddTHH:mm:ss.SSSSSS
  </code></pre>
  <p>At this point you might have picked up a couple of things:</p>
  <ol>
  <li>I have 2 problems: the &quot;T&quot; character in the middle and the precision that comes after the seconds (has 6 numbers, instead of just 3 (\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.<strong>\d{6}</strong>))</li>
  <li>I am totally lost and I am just guessing random combinations at this point</li>
  </ol>
  <h2>OK but flawed solution</h2>
  <p>The &quot;OK&quot; solution would be to use the &quot;Flexible Date&quot; converter, however if I do that I will lose the precision that comes after the seconds (those 6 decimals mentioned in point 1).</p>
  <p>Unfortunately for me, I <strong>need</strong> that amount of precision in my system, so I can't just cut out the last 6 decimals.</p>
  <h2>Questions</h2>
  <ol>
  <li>How can I fix my converter so it can properly override the Timestamp with the precision I need?</li>
  </ol>