[syslog-ng] Need help to send Datetime in BSON ISODATE to MongoDB?

[Ibrahim Al Mahfooz]

Hello,

I have integration working fine between syslog-ng v3.38 and MongoDB v6. I
am working to enable MongoDB Time-Series Collections on a testing DB for
the purpose of having better efficiency and improved queries over time.

I created the DB and collection, tested it by Mongo Compass client, then I
tried to send the data from syslog-ng but it didn't work. MongoDB is
throwing the following error:
"17:12:57. 483 | [2023-08-06T17:12:57.355549] Failed to insert into
MongoDB; time_reopen='10', reason='\'datetime\' must be present and contain
a valid BSON UTC datetime value', driver='d_mongodb_ttl#0"

My understanding is that it is a must to send the time/date to MongoDB with
Time Series enabled DB a BSON format Date. Any suggestions?

*Below is the mongoDB destination config:*

destination d_mongodb_ttl {
        mongodb(
        uri("mongodb://192.168.1.19:27017/syslog-ng_ttl")
        collection("logs")
        value-pairs(
        scope("selected-macros")
        exclude("SOURCEIP")
        exclude("TAGS")
        pair("datetime" "${S_ISODATE}")
        pair("privateip" "${privateip}")
        pair("publicip" "${publicip}")
        pair("publicportrange" "${publicportrange}")
        pair("portaction" "${AI}")
        pair("portstatus" "${AL}")
        pair("host" "${HOST}"))
        );
};


Appreciate your help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20230806/1201a7e9/attachment.htm>