On Mon, Aug 17, 2015 at 05:51:53PM +0700, Thanh Dat wrote: > Now I want to get the timestamp of this log record (Jul 27 00:04:41). How can I > do this ? you can refer to it using any of the time based macros: See the paragraph on macros "11.1.5. Macros of syslog-ng OSE"