There is currently not a good way to do this.
Assuming you don't want to use mmexternal for this, what you would have to do is
bsically treat it as a string conversion problem. mmnormalize would let you pull
out the pieces into $.day $.mont, $.year $.time and $.tz, you could then use the
pieces to form whatever string you need. If you need to convert to an actual
timestamp, then assemble a 'normal' timestamp and mmnormalize can read it as a
timestamp (that can then be converted with the normal property replacer
settings)
There is a major upgrade to mmnormalize that will be released in September,
While it doesn't have a flexible date parser yet, I wouldn't be surprised to see
it get one quickly (possibly before release)
David Lang
On Mon, 3 Aug 2015, chenlin rao wrote:
And another datestring as [03/Aug/2015:14:04:43 +0800].
2015-08-03 14:04 GMT+08:00 chenlin rao <[email protected]>:
I want convert date in php-errolog:
[03-Aug-2015 04:54:54 Asia/Shanghai] PHP Fatal error:
Or date in php-slowlog:
[03-Aug-2015 14:02:14] [pool v5] pid 27490
into 2015/08/03T14:02:14+0800.
2015-08-03 13:58 GMT+08:00 David Lang <[email protected]>:
what is the date string you are trying to convert from?
David Lang
On Mon, 3 Aug 2015, chenlin rao wrote:
%b in strptime, means 'Aug' for now.
2015-08-03 13:19 GMT+08:00 David Lang <[email protected]>:
what format is %b? (apache logfile uses %b for bytes returned.
it may be possible to parse the data with mmnormalize.
you can also use a custom script with mmexternal.
David Lang
On Mon, 3 Aug 2015, chenlin rao wrote:
It's difficult to transform %b into rfc339 format. So many logs use %b ,
error log, slow log etc.
2015-08-03 11:39 GMT+08:00 David Lang <[email protected]>:
On Mon, 3 Aug 2015, chenlin rao wrote:
I want a function like logstash-filter-date. For example:
```
$!datetime = strptime("%d/%m/%Y:%H:%M:%s", $!json!datetime);
template(name="ls" type="list") {property(name="!datetime"
dateFormat="rfc3339")...}
```
But seems like rainerscript can only return number, string, array or
json?
look at the property replacer
http://www.rsyslog.com/doc/v8-stable/configuration/property_replacer.html
It's not as simple to create arbitrary formats, but it covers a bunch
of
the formats you normally need.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
