If you change your datetime to be compsed of the epoc and the milliseconds it should work. pair("datetime" "${S_UNIXTIME}${S_MSEC}") Evan On 2023-08-06 08:04, Ibrahim Al Mahfooz wrote:
Hello,
I have integration working fine between syslog-ng v3.38 and MongoDB v6. I am working to enable MongoDB Time-Series Collections on a testing DB for the purpose of having better efficiency and improved queries over time.
I created the DB and collection, tested it by Mongo Compass client, then I tried to send the data from syslog-ng but it didn't work. MongoDB is throwing the following error: "17:12:57. 483 | [2023-08-06T17:12:57.355549] Failed to insert into MongoDB; time_reopen='10', reason='\'datetime\' must be present and contain a valid BSON UTC datetime value', driver='d_mongodb_ttl#0"
My understanding is that it is a must to send the time/date to MongoDB with Time Series enabled DB a BSON format Date. Any suggestions?
_Below is the mongoDB destination config:_
destination d_mongodb_ttl { mongodb( uri("mongodb://192.168.1.19:27017/syslog-ng_ttl <http://192.168.1.19:27017/syslog-ng_ttl>") collection("logs") value-pairs( scope("selected-macros") exclude("SOURCEIP") exclude("TAGS") pair("datetime" "${S_ISODATE}") pair("privateip" "${privateip}") pair("publicip" "${publicip}") pair("publicportrange" "${publicportrange}") pair("portaction" "${AI}") pair("portstatus" "${AL}") pair("host" "${HOST}")) ); };
Appreciate your help