Hi Vincent,

I am working on your date-parser() stuff that was integrated to syslog-ng-incubator recently. It is great stuff, so I'd like to make it part of the main syslog-ng codebase.

I am doing some cleanups, which you can follow at the f/date-parser branch in github.com/balabit/syslog-ng

I'd have a question though: I can see the date-offset() option for date parser, which seems to skip the specified number of characters in the input.

Can you please describe the usecase behind that? I'd be reluctant to add such an option to a parser (as none of the other have such an option), and it should be possible to do the same using template functions, e.g. something like this:

date-parser(template("$(substr $MSG 5)"));

This would similarly skip the first 5 characters.

If this addresses your original use-case, I'd drop the date-offset() option.

Thanks in advance,

--
Bazsi