search

blue-yonder / bonfire

A CLI Graylog Client with Follow Mode
BSD 3-Clause "New" or "Revised" License
72 stars 26 forks source link

known bug: timezone UTC #25

Closed hans-mayer closed 5 years ago

hans-mayer commented 6 years ago

Dear All,

Is there a workaround for this issue ? I am located in TZ Europe/Vienna. When I query with bonfire the last 10 minutes than I get the 10 minutes one hour ago. When I change the timezone of my graylog server to UTC, bonfire is working well but the web-interface of graylog doesn't show the last hour.

Maybe there is anywhere in program code a location where I can add or subtract 1 hour ? I know this is only an individual solution. But better than nothing.

Kind regards Hans

hans-mayer commented 6 years ago

Dear All,

As I see "bonfire" as a very useful tool I looked for a workaround by myself. My challenge was to run a cronjob with a query generating results for the last 10 minutes. Running a query with 

-@ "10 minutes ago"

I got the results an hour ago being in timezone CET. So I defined my timeframe using the GNU version of date: 

NOW60=`date "+%Y-%m-%d %H:%M:%S" -d '+ 60 minutes'`
NOW50=`date "+%Y-%m-%d %H:%M:%S" -d '+ 50 minutes'`

and the bonfire arguments are used in this way: 

--search-from "$NOW50" --search-to "$NOW60"

Maybe a workaround which is also feasible for you.

Kind regards Hans

valentin-krasontovitsch commented 5 years ago

Hmm, we actually don't have that problem with our graylog instance, even though we're in the same time zone... this might have been an issue with graylog rather than bonfire? Gonna close this for now, please feel free to reopen / bump if necessary.