Hi,
you have to use some filter (e. g. a Grok extractor with the pattern
%{COMMONAPACHELOG}) to extract the date from your web server access logs
and substitute the timestamp field of the message.
Cheers,
Jochen
On Wednesday, 23 November 2016 07:15:30 UTC+1, [email protected] wrote:
>
> Hello,
>
> I have few servers. Graylog is fetching logs from those server. Graylog is
> showing correct timestamp of the logs which is generated those server. But
> there is difference of 9 OR 6 OR 4 seconds.
>
> In below example you can see the first timestamp is showing 6 seconds more
> than the log
>
> 2016-11-23 09:53:09.000 server
> server1 AccesLogs xx.xx.xx.xx. 5 - - [23/Nov/*2016:09:53:03* +0400] "GET
> /sdfdsfdsf/sdfsdfdsf/sdfdsfsdfdsfds.js HTTP/1.1" 200 4343
>
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/5fac8e67-b9ca-4464-a57d-fbb847981e18%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
