Hello,
I think the problem is somewhere in the underlying libc library in
windows since the nxlog binary is the same on both versions.
This is the case with %z for sure, there was a discussion a while ago
about this on the list, search for "Timezones from Windows Event Logs" in
the archives.
We could switch to use our own strftime implementation instead of
relying on the one provided by the system so that this would work
consistently across all operating systems.
A workaround was to concatenate the timezone manually, e.g.
parsedate($timestring + " -0700")
Regards,
Botond
On Tue, 14 Jan 2014 15:45:10 -0500
Dillon Detour <dillondet...@gmail.com> wrote:
> Dividing by 1000000 seems to have worked and prevented the overflow. Don't
> get the miliseconds but in this case it is not an issue.
>
> Exec $EventTime = integer(parsedate($capturedTimeField)) / 1000000;
>
> I tried this before posting but did not change my logstash parser from
> UNIX_MS to UNIX.
>
>
> On Tue, Jan 14, 2014 at 3:07 PM, Dillon Detour <dillondet...@gmail.com>wrote:
>
> > I am trying to parse events on multiple servers in different timezone
> > regions.
> >
> > The events do not have the timezone offset so I intend to use parsedate()
> > without specifying the timezone believing that it will use the local
> > timezone on the server when it creates the UTC datetime object.
> >
> > The following works great on windows 7 but I can't get it to work on
> > Server 2003:
> > Exec $EventTime = integer(parsedate("2014-01-14 15:34:49")) / 1000;
> >
> > It appears that on XP/2003 the value overflows and is only a 32 bit
> > integer.
> >
> > I am open to other ways to solve the problem of preserving timezone
> > information. For example I tried capturing the offset of the system by
> > doing this:
> > $timezone = strftime(now(), "%z")
> > but on windows the format string always shows the unabbreviated version
> > ("Eastern Standard Time" instead of EST or -0500) which makes parsing it
> > later a nightmare.
> >
> > Any help is greatly appreciated!
> >
> >
> >
> >
------------------------------------------------------------------------------
CenturyLink Cloud: The Leader in Enterprise Cloud Services.
Learn Why More Businesses Are Choosing CenturyLink Cloud For
Critical Workloads, Development Environments & Everything In Between.
Get a Quote or Start a Free Trial Today.
http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
_______________________________________________
nxlog-ce-users mailing list
nxlog-ce-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
