Graylog2 / Graylog2/graylog2-server
timestamp extractor not working
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Hi!
I´m forwarding Cisco Syslog Massages collected by a syslog-ng instance as UDP massages to the Graylog server. The reason why i´m forwarding them as UDP and not as gelf-formatted messages is, that UDP is the only method supported by syslog-ng where it´s possible to spoof the source ip address.
If there are many messages from the same source within a second, they are often not displayed in the correct order in graylog. The timestamp within graylog always is without milliseconds.
To resolve this issue, i´ve tried to export the timestamp within the textual syslog message as timestamp for graylog. I´ve used the "date" converter and tried following format strings: "MMM d HH:mm:ss.SSS" and "MMM dd HH:mm:ss.SSS".
As a result all these syslog-messages were dropped and i got many indexer failures like the following one: "MapperParsingException[failed to parse [timestamp]]; nested: MapperParsingException[failed to parse date field [Nov 9 10:55:57.182], tried both date format [yyyy-MM-dd HH:mm:ss.SSS], and timestamp number with locale []]; nested: IllegalArgumentException[Invalid format: "Nov 9 10:55:57.182"]; ".
The same result is with the flexible date converter.
Did i do anything wrong or is this a bug?
Kind regards
Contributor guide
Assessment
This issue has not been assessed yet.