sending time with milliseconds to graylog
Tags:
#1
spodius
I have been using nxlog-ce-2.9.1716 to send logs in graylog. In graylog timestemp is without milliseconds. For parsing string to date I use such code
if ( $raw_event =~ /^(\d{4}-\d\d-\d\d\s\d{1,2}:\d{1,2}:\d{1,2},\d{1,3})\s[\d+]\s(\S+)\s+\s+(.*)/ )
{
$EventTime = parsedate($1);
$EventTime = parsedate(strftime($EventTime, '%Y-%m-%d %H:%M:%SZ'));
}
In this case I lost milliseconds.
How can I use parsedate() method with milliseconds and converting time to UTC?
#1
spodius
I have been using nxlog-ce-2.9.1716 to send logs in graylog. In graylog timestemp is without milliseconds. For parsing string to date I use such code
if ( $raw_event =~ /^(\d{4}-\d\d-\d\d\s\d{1,2}:\d{1,2}:\d{1,2},\d{1,3})\s[\d+]\s(\S+)\s+\s+(.*)/ )
{
$EventTime = parsedate($1);
$EventTime = parsedate(strftime($EventTime, '%Y-%m-%d %H:%M:%SZ'));
}
In this case I lost milliseconds.
How can I use parsedate() method with milliseconds and converting time to UTC?
Hi,
Please check these instructions from Graylog: http://docs.graylog.org/en/2.4/pages/collector_sidecar.html?highlight=Known%20Problems#known-problems
Specifically the Known Issues section
-MisaZ
