Re: Syslog timestamp

[Mark Payne]

Madhukar,

Currently, I don't think there's any really easy way to do this. You'd have to 
use a RouteOnAttribute
with a regex, probably to determine which date format is being used, and then 
use another processor to 
perform the toDate() function.

That being said, this is a good idea of something that we should support. If 
you want to file a JIRA, we could
certainly incorporate something, so that you can provide multiple date formats 
and it would just use whichever
one works. For example, you should be able to do:
${syslog.timestamp:toDate("MMM d HH:mm:ss", "-MM-dd'T'HH:mm:ss.SZ", 
"-MM-dd'T'HH:mm:ss.S+hh:mm")}

Thanks
-Mark


> On Aug 5, 2016, at 1:40 PM, Madhukar Thota <madhukar.th...@gmail.com> wrote:
> 
> Any help?
> 
> On Thu, Aug 4, 2016 at 5:25 AM, Madhukar Thota <madhukar.th...@gmail.com 
> <mailto:madhukar.th...@gmail.com>> wrote:
> How to convert Both RFC5424 and RFC3164 syslog timestamp attribute to type to 
> long. 
> 
> Will some thing like this works?
> 
> ${syslog.timestamp:toDate('MMM d HH:mm:ss'):toNumber():or(
>${syslog.timestamp:toDate("-MM-dd'T'HH:mm:ss.SZ"):toNumber()}
> ):or(
>${syslog.timestamp:toDate("-MM-dd'T'HH:mm:ss.S+hh:mm"):toNumber()}
> )}
> 

Re: Syslog timestamp

[Madhukar Thota]

Any help?

On Thu, Aug 4, 2016 at 5:25 AM, Madhukar Thota <madhukar.th...@gmail.com>
wrote:

> How to convert Both RFC5424 and RFC3164 syslog timestamp attribute to
> type to long.
>
> Will some thing like this works?
>
> ${syslog.timestamp:toDate('MMM d HH:mm:ss'):toNumber():or(
>${syslog.timestamp:toDate("-MM-dd'T'HH:mm:ss.SZ"):toNumber()}
> ):or(
>${syslog.timestamp:toDate("-MM-dd'T'HH:mm:ss.S+hh:mm"):toNumber()}
> )}
>

Syslog timestamp

[Madhukar Thota]

How to convert Both RFC5424 and RFC3164 syslog timestamp attribute to type
to long.

Will some thing like this works?

${syslog.timestamp:toDate('MMM d HH:mm:ss'):toNumber():or(
   ${syslog.timestamp:toDate("-MM-dd'T'HH:mm:ss.SZ"):toNumber()}
):or(
   ${syslog.timestamp:toDate("-MM-dd'T'HH:mm:ss.S+hh:mm"):toNumber()}
)}