NXLOG - csv field need to parse on date format - how to convert 10Nov2016 to YYYY-MM-DD

#1 Ana 7 years ago

Hello,

I'm catching up logs, but when they arrived to my Graylog, they take the actual date and not the old date.

I saw my logs and they don't have format date. They're csv, and I have this field :

FW_date_time:10Nov2016;21:40:10

and I need to assign it on the timestamp, but I don't kno how.

Could you help me please to convert this on a good format?

I tried this (I have a field called: FW_date_time on my source csv file):

Exec FW->parse_csv();

Exec $EventReceivedTime =strptime($FW_date_time, '%Y %b %d %T');

Exec $EventTime =strptime($FW_date_time, '%Y %b %d %T');

But it didn't work.

Thank you very much for your help.

Cordially,

Ana

Permalink

#2 b0ti Nxlog ✓ 7 years ago

#1 Ana

Hello, I'm catching up logs, but when they arrived to my Graylog, they take the actual date and not the old date. I saw my logs and they don't have format date. They're csv, and I have this field : FW_date_time:10Nov2016;21:40:10 and I need to assign it on the timestamp, but I don't kno how. Could you help me please to convert this on a good format? I tried this (I have a field called: FW_date_time on my source csv file): Exec FW->parse_csv(); Exec $EventReceivedTime =strptime($FW_date_time, '%Y %b %d %T'); Exec $EventTime =strptime($FW_date_time, '%Y %b %d %T'); But it didn't work. Thank you very much for your help. Cordially, Ana

You need to provide the correct format to strptime() that matches 10Nov2016;21:40:10.