search

wizecore / graylog2-output-syslog

Customizable, production ready syslog and ArcSight output plugin for Graylog
Apache License 2.0
38 stars 19 forks source link

Snare output does not use the raw message timestamp #49

Open mrcdb opened 2 years ago

mrcdb commented 2 years ago

Hi,

I am using the plugin to forward a Windows Event (collected via NXLog) to an external system in snare format. By analysing the raw message, it looks like that the syslog output in Snare format adds a new timestamp that differs from the one in the original Graylog message.

More specifically, each Graylog message includes a timestamp field with the correct event time. The message that is forwarded by the syslog output has a different timestamp (usually, a few seconds in the future due to processing time).

Is it possible to avoid this behaviour and have the output plugin use the original timestamp from the timestamp field? I am using Graylog 3.3.14 with the plugin release  3.3.2.

Thanks.

mrcdb commented 2 years ago

Addressed in #50