<div dir="ltr">Hello,<div><br></div><div>There are a few date related macros, and I think you are looking for the $ISODATE. Of course first you have to fix up the date with the </div><div><br></div><div><div>Configuration:</div></div><div><div>@version: 3.15</div><div><br></div><div>log {</div><div> source{internal();};</div><div> source{stdin(flags(no-parse));};</div><div> parser { kv-parser(); </div><div> date-parser(format("%s") template("${generateTime}"));</div><div> };</div><div> destination{file("/dev/stdout" template("$ISODATE $MSG\n") frac-digits(3));};</div><div>};</div></div><div><br></div><div><br></div><div><br></div><div>Console:</div><div><div>Input:</div><div> Apr 25 16:46:51 <a href="http://host.example.net">host.example.net</a> .., generateTime=1524674663, ...</div><div><br></div><div>Output:</div><div>2018-04-25T18:44:23.000+02:00 Apr 25 16:46:51 <a href="http://host.example.net">host.example.net</a> .., generateTime=1524674663, ...</div></div><div><br></div><div>You may need to tweak the configuration further more.</div><div><br></div><div>--</div><div>Kokan</div></div><br><div class="gmail_quote"><div dir="ltr">On Thu, Apr 26, 2018 at 4:48 AM Asif Iqbal <<a href="mailto:vadud3@gmail.com">vadud3@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Wed, Apr 25, 2018 at 10:36 PM, Asif Iqbal <span dir="ltr"><<a href="mailto:vadud3@gmail.com" target="_blank">vadud3@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote"><span class="m_2497497858197030240gmail-">On Wed, Apr 25, 2018 at 12:57 PM, Asif Iqbal <span dir="ltr"><<a href="mailto:vadud3@gmail.com" target="_blank">vadud3@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote"><span>On Wed, Apr 25, 2018 at 12:49 PM, Asif Iqbal <span dir="ltr"><<a href="mailto:vadud3@gmail.com" target="_blank">vadud3@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">How do I change the time in the log to append a timezone. Timestamp should be based on generateTime=1523620861 which is in the log<div><br></div><div>So today the time in the shows like this </div><div><br></div><div> Apr 25 16:46:51 <a href="http://host.example.net" target="_blank">host.example.net</a> .., generateTime=1524674663, ...</div><div><br></div><div>I like to change it like below</div><div><br></div><div> 2018-04-25T16:46:55+0000 <a href="http://host.example.net" target="_blank">host.example.net</a> ...,generateTime=1524674663, ....</div><div><br></div><div><br><div> <br></div></div></div></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><div></div><div><br></div><div><br clear="all"><div>{"PROGRAM":"alarmLog,","PRIORITY":"notice","MESSAGE":"applianceName=KING-MER-50-PRI, tenantName=king, alarmType=vrrp-v3-proto-error, alarmKey=0|vni-0/3.0, generateTime=1523620861, applianceId=1, vsnId=0, tenantId=4, alarmCause=causeOther, alarmClearable=no, alarmClass=new, alarmKind=root, alarmEventType=equipmentAlarm, alarmSeverity=indeterminate, alarmOwner=tenant, alarmSeqNo=36657, alarmText=\"vni-0/3.0\", siteName=","HOST":"<a href="http://host.example.net" target="_blank">host.example.net</a>","FACILITY":"user","DATE":"Apr 13 04:01:22"}</div></div></div></div></blockquote><div><br></div><div><br></div></span><div>That was the output of </div><div><br></div><div> filter f_alarm { facility(user) and match("alarmLog" value("PROGRAM")); };<br></div><div> </div><div> destination d_alarm { file ("/var/log/alarms.log" template("$(format-json -s syslog-proto)\n")); };</div><span><div><br></div></span></div></div></div></blockquote><div><br></div><div><br></div><div><br></div></span><div>I am using syslog-ng version 3.5.6, latest from centos 7</div><span class="m_2497497858197030240gmail-"><div><br></div><div> </div></span></div></div></div></blockquote><div><br></div></div></div></div><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div>upgrade to syslog-ng 3.14 using the repo from here <a href="https://syslog-ng.com/blog/installing-latest-syslog-ng-on-rhel-and-other-rpm-distributions/" target="_blank">https://syslog-ng.com/blog/installing-latest-syslog-ng-on-rhel-and-other-rpm-distributions/</a></div></div></div></div><div dir="ltr"><div class="gmail_extra"><br><br clear="all"><div><br></div>-- <br><div class="m_2497497858197030240gmail_signature">Asif Iqbal<br>PGP Key: 0xE62693C5 KeyServer: <a href="http://pgp.mit.edu" target="_blank">pgp.mit.edu</a><br>A: Because it messes up the order in which people normally read text.<br>Q: Why is top-posting such a bad thing?<br><br></div>
</div></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>