[syslog-ng] Need help to send Datetime in BSON ISODATE to MongoDB?

[Evan Rempel]

If you change your datetime to be compsed of the epoc and the 
milliseconds it should work.

pair("datetime" "${S_UNIXTIME}${S_MSEC}")

Evan

On 2023-08-06 08:04, Ibrahim Al Mahfooz wrote:
>
> Hello,
>
> I have integration working fine between syslog-ng v3.38 and MongoDB 
> v6. I am working to enable MongoDB Time-Series Collections on a 
> testing DB for the purpose of having better efficiency and improved 
> queries over time.
>
> I created the DB and collection, tested it by Mongo Compass client, 
> then I tried to send the data from syslog-ng but it didn't work. 
> MongoDB is throwing the following error:
> "17:12:57. 483 | [2023-08-06T17:12:57.355549] Failed to insert into 
> MongoDB; time_reopen='10', reason='\'datetime\' must be present and 
> contain a valid BSON UTC datetime value', driver='d_mongodb_ttl#0"
>
> My understanding is that it is a must to send the time/date to MongoDB 
> with Time Series enabled DB a BSON format Date. Any suggestions?
>
> _Below is the mongoDB destination config:_
>
> destination d_mongodb_ttl {
>         mongodb(
>         uri("mongodb://192.168.1.19:27017/syslog-ng_ttl 
> <http://192.168.1.19:27017/syslog-ng_ttl>")
>         collection("logs")
>         value-pairs(
>         scope("selected-macros")
>         exclude("SOURCEIP")
>         exclude("TAGS")
>         pair("datetime" "${S_ISODATE}")
>         pair("privateip" "${privateip}")
>         pair("publicip" "${publicip}")
>         pair("publicportrange" "${publicportrange}")
>         pair("portaction" "${AI}")
>         pair("portstatus" "${AL}")
>         pair("host" "${HOST}"))
>         );
> };
>
>
> Appreciate your help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20230806/dc1a96a5/attachment.htm>