CEF Parser timestamp conversion #5
Comments
satoaki-ooto
added a commit
to satoaki-ooto/fluent-plugin-parser_cef
that referenced
this issue
Oct 21, 2023
Update file .gitlab-ci.yml Closes lunardial#5 See merge request ooto-me/fluent-plugin-parser-cef!2
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Is it possible to convert the timestamp using this parser from '\w{3}\s+\d{1,2}\s\d{2}:\d{2}:\d{2}' to %Y-%m-%dT%H:%M:%S %z ? if so, how? i've tried various methods but were not successful.
my incoming log example format:
Jun 07 20:21:45 SERVER_NAME CEF:0|App-Name|Sub-Cat|12.1.0000|295|Retrieve password|5|act=Retrieve password suser=username fname=Root\Operating System-WindowsADServiceAccount-company.com-server01dev dvc=##.###.##.### shost==##.###.##.### dhost=company.com duser=username-dev externalId= app= reason= cs1Label="User Name" cs1= cs2Label="Some Name" cs2=Some Accounts - ABCD cs3Label="Device Type" cs3=Operating System cs4Label="LabelName" cs4= cs5Label="Other info" cs5==##.###.##.### cn1Label="Request Id" cn1= cn2Label="Ticket Id" cn2=(Action: Show Password) msg=(Action: Show Password)The text was updated successfully, but these errors were encountered: