Quantcast
Channel: VMware Communities : All Content - All Communities
Viewing all articles
Browse latest Browse all 175326

Use provided timestamp as event time

$
0
0

Hello,

 

I'm sending logs to logInsight and want the event time to use the provided timestamp.

Example :

timestamp=22-01-2020 15:12:53;template=;dataid=StoreHeader:storeId:11708

timestamp=22-01-2020 15:12:53;template=;dataid=StoreHeader:storeId:11101

 

The parsing is correct but the event time does not use the provided timestamp but the time when the log data is processed by the agent..

 

 

What's the correct way to have LogInsigh using the provided timestamp ?

 

Used parser:

 

[parser|CacheivlParser]

base_parser=kvp

fields=*

delimiter=";"

debug=yes

field_decoder={"timestamp": "TableSize_tsp_parser"}

 

[parser|TableSize_tsp_parser]

base_parser=timestamp

debug=no

format=%d-%m-%Y %H:%M:%S


Viewing all articles
Browse latest Browse all 175326

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>