Open yangshike opened 7 months ago
The year is inferred using the current time in UTC, and the month as parsed from the log message (without any conversion).
This seems to be where the problems occur. The message's month could be different in UTC if the message is in a different timezone. The code is shared between Vector and a dependency syslog_loose
.
syslog_loose
takes a resolve_year
closure, runs it and builds a datetime with the result, and then converts the built datetime using an optional offset.resolve_year
closure.I don't understand what's gone wrong exactly and how it managed to end up with 2022, but I think it's likely to be in this resolve_year
and syslog_loose
interaction.
Timezones are hard.
A note for the community
Problem
When the system time is (+800) 2024-01-01 00:00:00 - 2024-01-01 08:00
The timestamp field parsed through parse_syslog becomes 2022, this bug is reproducible
screenshot:
Configuration
Version
0.33
Debug Output
No response
Example Data
Comparison of original log and log processed by vector:![image](https://github.com/vectordotdev/vector/assets/13585274/fc4df82e-b329-4bd5-9313-8712b5124ac5)
Additional Context
No response
References
No response