Graylog2 didn't recognize the event date
Description
Attachments
Gliffy Diagrams
Activity
John E. Vincent May 25, 2012 at 5:15 AM
The float change had already been made. I explicitly set the gelf gem version in Gemfile.
Thibault Desaules March 19, 2012 at 3:18 PM
Ok, after some research I found the problem, In the jar release, the gelf gem version is not good. It use the 1.1.3 not the last (1.3.2 here : https://github.com/Graylog2/gelf-rb)
After that, just made somes changes in logstash/outputs/gelf.rb :
[...]
m["timestamp"] = event.unix_timestamp.to_f
[...]
@gelf.notify!(m)
[...]
is that possible to make the changes in the next logstash version ?
Thibault Desaules February 27, 2012 at 11:36 AM
have you made somes changes on the code ? because I can't get the good timestamp in graylog2
Thibault Desaules February 27, 2012 at 10:10 AM
I make a test with the mutate filter but nothing change... I will send you a mail with all my conf
John E. Vincent February 26, 2012 at 5:25 AM
One thing to make sure of is the following:
Using JRuby
There's currently an open bug with regards to usage on MRI. Logstash currently use JODA for datetime so it can affect some plugins that explicitly call 'event.unix_timestamp'
I'm currently testing with master.
I'm going to modify the code to at least send the timestamp in float since that's what the GELF spec says.
(timestamp: UNIX microsecond timestamp (decimal); SHOULD be set by client library.)
Thibault, can you provide me again with a few sample log lines and your current grok and date filters? I want to do some more testing closer to your setup.
Graylog2 didn't recognize the event date, just using the date of receiving the event.
I'm using gelf output plugin to communicate with graylog2.
I'm parsing the timestamp fields with the date filter.
Sample:
Input:
stdout:
graylog2 event view:
My idea:
the date filter sets the "@timestamp" field, but gelf output plugin uses "event.unix_timestamp" and I didn't find any line where logstash sets the unix_timestamp field (and convert the ISO formatted timestamp to unixtime).