<p dir="ltr">This seems like ab rfc5424 style message, eg the syslog driver. There the format of the timestamp is defined by the rfc and cannot be overridden.</p>
<p dir="ltr">If you want to customize the format on the network you should be using the network() driver (used to be called tcp() in older versions) there you can override the message format with the template () parameter.</p>
<p dir="ltr">ts_format() only controls formatting of file destinations in case a template is not present or when you explicitly use the $STAMP macro.</p>
<div class="gmail_quote">On Mar 27, 2014 6:46 PM, "Ou, Jimmy" <<a href="mailto:Jimmy.Ou@viasat.com">Jimmy.Ou@viasat.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal">Hello,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I am having trouble using the timestamp formatter.<u></u><u></u></p>
<p class="MsoNormal">The document says I can use ts_format() as rfc3164, bsd, rfc3339, or iso.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I’ve tried multiple values and have gotten the same result.<u></u><u></u></p>
<p class="MsoNormal">I’ve tried putting the ts_format(rfc3339) in the global options and in the destination’s syslog() and have gotten the same result.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">My test logs show the following no matter what ts_format I set:<u></u><u></u></p>
<p class="MsoNormal"><113><span style="color:red">1 2014-11-25T11:00:00+00:00 </span>
10.1.1.1 RedBox - <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I want it to look like the following:<u></u><u></u></p>
<p class="MsoNormal"><113><span style="color:red">1 2014-11-25T11:00:00.000Z </span>
10.1.1.1 RedBox – <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Am I missing something?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks,<u></u><u></u></p>
<p class="MsoNormal">Jimmy Ou<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div>