It was added in version 3.8, so you should install a more recent version of syslog-ng. You can find links to download locations and documentation at https://syslog-ng.org/3rd-party-binaries/ Bye, Peter Czanik (CzP) <peter.czanik@balabit.com> Balabit / syslog-ng upstream https://www.balabit.com/blog/author/peterczanik/ https://twitter.com/PCzanik On Tue, Jun 13, 2017 at 12:15 PM, Sandbox <sandboxheh@gmail.com> wrote:

Hi,

I would like to use the date-parser.

When i using the below parse it says "date-parser not found":

parser haproxy_date { date-parser( format("%d/%m/%Y:%H:%M:%S %z") template("$(substr ${MSG} 0 27)") );. };

Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng/3.5.6', module='date-parser' Error parsing parser expression, parser plugin date-parser not found in /etc/syslog-ng/conf.d/20-haproxy.conf at line 26, column 5: included from /etc/syslog-ng/syslog-ng.conf line 165, column 1

date-parser( ^^^^^^^^^^^

It's weird, because when i try to use the date-parser module in the log section:

log { source(s_haproxy); filter(f_haproxy_info); date-parser(format("%d/%m/%Y:%H:%M:%S %z") template("$(substr ${MSG} 0 27)") ); destination(d_haproxy_info); };

it says:

Error parsing log, syntax error, unexpected LL_IDENTIFIER, expecting '}' in /etc/syslog-ng/conf.d/20-haproxy.conf at line 37, column 5: included from /etc/syslog-ng/syslog-ng.conf line 165, column 1

date-parser(format("%d/%m/%Y:%H:%M:%S %z") template("$(substr ${MSG} 0 27)") ); ^^^^^^^^^^^

In OSE version the date-parser module is not available, or i'm missing something?

Thanks, Robert

____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

Hi, On Tue, Jun 13, 2017 at 12:15:00PM +0200, Sandbox wrote:

Plugin module not found in 'module-path'; module-path='/usr/lib/syslog-ng/3.5.6', module='date-parser' Error parsing parser expression, parser plugin date-parser not found in /etc/syslog-ng/conf.d/20-haproxy.conf at line 26, column 5:

Your syslog-ng version is too old. It has been added in syslog-ng-3.8.1. If you can't upgrade, you might wanna check out the incubator which might be available for your version of syslog-ng.

It's weird, because when i try to use the date-parser module in the log section:

log { source(s_haproxy); filter(f_haproxy_info); date-parser(format("%d/%m/%Y:%H:%M:%S %z") template("$(substr ${MSG} 0 27)") ); destination(d_haproxy_info); };

it says:

Error parsing log, syntax error, unexpected LL_IDENTIFIER, expecting '}' in /etc/syslog-ng/conf.d/20-haproxy.conf at line 37, column 5:

that's perfectly normal: if you want to use inline blocks the correct syntax would be: log { ... parser { date-parser( ... ); }; ... };