2015-11-24 8:10 GMT+01:00 Ciprian Hacman <[email protected]>: > Hi, > > I was actually thinking of creating a PR for accepting " " instead of "T" > between date and time. > @Rainer: Would it be ok?
Depends on how you do it ;) For example, in RFC 5424 messages, this is not acceptable. So this must be a new data parsing function, or an option to the existing one. Rainer > > Thanks, > Ciprian > -- > Performance Monitoring * Log Analytics * Search Analytics > Solr & Elasticsearch Support * http://sematext.com/ > > On Mon, Nov 16, 2015 at 2:13 PM, Radu Gheorghe <[email protected]> > wrote: > >> Hello, >> >> As far as I know, this isn't a date format that rsyslog (or liblognorm) >> understands. Because it's not an RFC-3339 timestamp, nor a traditional >> RFC-3164-syslog timestamp. >> >> So far, we've only hacked our way into parsing this with mmnormalize by >> getting the two bits (the date and the time) as strings and "stitching" >> them together in a template (adding a "T" in the middle) and the default >> timezone to get an RFC-3339 timestamp. Ugly, but we don't have custom date >> formats in liblognorm as far as I know. May be a useful feature to add at >> some point. >> >> Alternatively, you may be able to modify the date format used by the >> logging application into a "standard" one that rsyslog understands. >> >> Best regards, >> Radu >> -- >> Performance Monitoring * Log Analytics * Search Analytics >> Solr & Elasticsearch Support * http://sematext.com/ >> >> On Mon, Nov 16, 2015 at 9:18 AM, Vicks Mortal <[email protected]> >> wrote: >> >> > Hello All >> > >> > Can Somebody tell me which Date Format is of the Line Below? and whats >> the >> > syntax/keyword for it in rsyslog >> > >> > [2015-11-14 17:10:26,589] INFO:shutdown:Shutdown Server! - SIGTERM >> > >> > Regards >> > _______________________________________________ >> > rsyslog mailing list >> > http://lists.adiscon.net/mailman/listinfo/rsyslog >> > http://www.rsyslog.com/professional-services/ >> > What's up with rsyslog? Follow https://twitter.com/rgerhards >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> > DON'T LIKE THAT. >> > >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
