Dividing by 1000000 seems to have worked and prevented the overflow. Don't
get the miliseconds but in this case it is not an issue.
Exec $EventTime = integer(parsedate($capturedTimeField)) / 1000000;
I tried this before posting but did not change my logstash parser from
UNIX_MS to UNIX.
On Tue, Jan 14, 2014 at 3:07 PM, Dillon Detour <dillondet...@gmail.com>wrote:
> I am trying to parse events on multiple servers in different timezone
> regions.
>
> The events do not have the timezone offset so I intend to use parsedate()
> without specifying the timezone believing that it will use the local
> timezone on the server when it creates the UTC datetime object.
>
> The following works great on windows 7 but I can't get it to work on
> Server 2003:
> Exec $EventTime = integer(parsedate("2014-01-14 15:34:49")) / 1000;
>
> It appears that on XP/2003 the value overflows and is only a 32 bit
> integer.
>
> I am open to other ways to solve the problem of preserving timezone
> information. For example I tried capturing the offset of the system by
> doing this:
> $timezone = strftime(now(), "%z")
> but on windows the format string always shows the unabbreviated version
> ("Eastern Standard Time" instead of EST or -0500) which makes parsing it
> later a nightmare.
>
> Any help is greatly appreciated!
>
>
>
>
------------------------------------------------------------------------------
CenturyLink Cloud: The Leader in Enterprise Cloud Services.
Learn Why More Businesses Are Choosing CenturyLink Cloud For
Critical Workloads, Development Environments & Everything In Between.
Get a Quote or Start a Free Trial Today.
http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
_______________________________________________
nxlog-ce-users mailing list
nxlog-ce-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
