elastic / elastic/integrations
[system]: syslog parsed with future timestamps
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Integration Name
System [system]
### Dataset Name
system.syslog
### Integration Version
1.6.4
### Agent Version
9.2.2
### Agent Output Type
elasticsearch
### Elasticsearch Version
9.3.0
### OS Version and Architecture
Azure AKS on Ubuntu
### Software/API Version
_No response_
### Error Message
_No response_
### Event Original
/var/log/messages have a log format without year:
```
Mar 18 00:00:07 aks-management2-24323487-vmss000000 systemd[1]: rsyslog.service: Sent signal SIGHUP to main process 1048 (rsyslogd) on client request.
Mar 18 00:00:07 aks-management2-24323487-vmss000000 systemd[1]: logrotate.service: Deactivated successfully.
```
When we parse it we don't know which year it was produced in.
https://github.com/elastic/integrations/blob/main/packages/system/data_stream/syslog/elasticsearch/ingest_pipeline/log.yml#L17-L21
So if in January it reads an old log that's say Dec 30, it thinks it's Dec 30 this year, so almost a year ahead.
This causes queries to be slower because we have a ton of optimizations around `@timestamp` being limited, e.g. we skip shards that can't match.
We should check after parsing if the timestamp is in the future, and either correct it to last year, or clamp it to "now"/ingest timestamp.
### What did you do?
```
- data_stream:
dataset: system.syslog
type: logs
paths:
- /var/log/messages*
- /var/log/syslog*
- /var/log/system*
exclude_files:
- .gz$
multiline:
pattern: ^\s
match: after
processors:
- add_fields:
target: ''
fields:
ecs.version: 1.12.0
```
### What did you see?
Dec 7 00:00:03
turns into
Dec 7, 2026 @ 00:00:03.000
### What did you expect to see?
But expected
Dec 7, 2025 @ 00:00:03.000
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.