Graylog2 / Graylog2/graylog2-server

timestamp extractor not working

Open
#1,577 1 comment 0 reactions 0 assignees View on GitHub
bug P3 S2 severe triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Hi!

I´m forwarding Cisco Syslog Massages collected by a syslog-ng instance as UDP massages to the Graylog server. The reason why i´m forwarding them as UDP and not as gelf-formatted messages is, that UDP is the only method supported by syslog-ng where it´s possible to spoof the source ip address.
If there are many messages from the same source within a second, they are often not displayed in the correct order in graylog. The timestamp within graylog always is without milliseconds.
To resolve this issue, i´ve tried to export the timestamp within the textual syslog message as timestamp for graylog. I´ve used the "date" converter and tried following format strings: "MMM d HH:mm:ss.SSS" and "MMM dd HH:mm:ss.SSS".

As a result all these syslog-messages were dropped and i got many indexer failures like the following one: "MapperParsingException[failed to parse [timestamp]]; nested: MapperParsingException[failed to parse date field [Nov 9 10:55:57.182], tried both date format [yyyy-MM-dd HH:mm:ss.SSS], and timestamp number with locale []]; nested: IllegalArgumentException[Invalid format: "Nov 9 10:55:57.182"]; ".

The same result is with the flexible date converter.
Did i do anything wrong or is this a bug?
Kind regards

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.