timestamp from extra defined field

[Shaoranlaos]

It should be possible to define a field from which to read the timestamp to use in the syslog message like it is now possible for all other fields in a syslog message. e.g.

syslog {
  host => "syslog-server"
  port => 514
  protocol => "udp"
  timestamp => "syslog-date"
}

This would help with some problems that come with the inability of a syslog server to understand timezones.

[MartijnvdB]

I second this request. We send the output of this module to a monitoring system which displays the alert in GMT, which is two hours from the actual alert occurence.

[pznamensky]

+1

[Foxeronie]

+1, same problem like MartijnvdB

some output is send to ossec and in the logs you can see -2 hours difference between the actual timestamp and the received timestamp

[Foxeronie]

A small workaround. In Ubuntu I edited the file /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-syslog-3.0.5/lib/logstash/outputs/syslog.rb and added the following lines:

[...]
if @is_rfc3164
  timestamp = event.sprintf("%{+MMM dd HH:mm:ss}")
  # Add offset of two hours
  timestamp_new = DateTime.parse(timestamp)
  timestamp_new = timestamp_new.new_offset('+02:00')
  timestamp = timestamp_new.strftime('%h %e %H:%M:%S')

The timestamp has now an offset of +2 hours. You need to restart logstash.