responses
I am trying to use NXlog to ship Event Logs and IIS logs to Graylog. No matter what I do in NXlog the IIS log timestamp in Graylog is the same as the EventReceivedTime. However, the Event Log timestamps are correct. Here is a link to my config on pastebin. All the configs I found on Google set the EventTime the same way. See anything wrong?
$EventTime = parsedate($date + " " + $time); \
I tried doing a WireShark capture to see what the difference was. NXlog compresses the data before sending it. I haven't taken the time to learn how to uncompressit. I also tried setting the timestamp manually. That didn't work either...
$timestamp = integer(parsedate($date + " " + $time))/1000; \
Comments (2)
I don't know believe it is undefined. I have added the folowing to fields to test with. $TestTime has lost the milisecond percission, so the type is DateTime I believe.
$TestTime = parsedate($date + " " + $time); \
$TestTime2 = $date + " " + $time; \
Values in Graylog:
TestTime = 2015-10-15 20:09:07
TestTime2 = 2015-10-15 20:09:07.835
I fixed this. It just needed a Z added to the end of the string.
$EventTime = parsedate($date + " " + $time + "Z"); \