# My Timestamp in audit log using SYSLOG input plugin not in correct format **URL:** \ **Category:** Logstash\ **Created:** [January 16, 2024, 7:47am UTC](https://discuss.elastic.co/t/my-timestamp-in-audit-log-using-syslog-input-plugin-not-in-correct-format/351127 "2024-01-16T07:47:57Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Subrato1](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@Subrato1](https://discuss.elastic.co/u/Subrato1)\ **Post date:** [January 16, 2024, 7:47am UTC](https://discuss.elastic.co/t/my-timestamp-in-audit-log-using-syslog-input-plugin-not-in-correct-format/351127/1 "2024-01-16T07:47:57Z")
Configuration is below : ```auto input { syslog { port => 5514 type => "scylladb" } } filter { if [type] == "scylladb" { grok{ match => {"message" => "%{IP:server_ip}:%{DATA:server_port},\s%{DATA:category},\s%{DATA:consistency},\s%{DATA:table_name},\s%{DATA:keyspace_name},\s%{GREEDYDATA:operation},\s%{DATA:source}:%{DATA:source_port},\s%{DATA:username},\s%{GREEDYDATA:error}" } } if "_grokparsefailure" in [tags] { drop{} } } } output { stdout { codec => rubydebug } } ``` My syslog configuration: ```auto # /etc/rsyslog.conf configuration file for rsyslog # # For more information install rsyslog-doc and see # /usr/share/doc/rsyslog-doc/html/configuration/index.html # # Default logging rules can be found in /etc/rsyslog.d/50-default.conf ################# #### MODULES #### ################# module(load="imuxsock") # provides support for local system logging #module(load="immark") # provides --MARK-- message capability # provides UDP syslog reception #module(load="imudp") #input(type="imudp" port="514") # provides TCP syslog reception #module(load="imtcp") #input(type="imtcp" port="514") # provides kernel logging support and enable non-kernel klog messages module(load="imklog" permitnonkernelfacility="on") ########################### #### GLOBAL DIRECTIVES #### ########################### # # Use traditional timestamp format. # To enable high precision timestamps, comment out the following line. # $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # Filter duplicated messages $RepeatedMsgReduction on # # Set the default permissions for all log files. # $FileOwner syslog $FileGroup adm $FileCreateMode 0640 $DirCreateMode 0755 $Umask 0022 $PrivDropToUser syslog $PrivDropToGroup syslog # # Where to place spool and state files # $WorkDirectory /var/spool/rsyslog # # Include all config files in /etc/rsyslog.d/ # $IncludeConfig /etc/rsyslog.d/*.conf #Send logs to client server $PreserveFQDN on *.* @:5514 $ActionQueueFileName queue $ActionQueueMaxDiskSpace 1g $ActionQueueSaveOnShutdown on $ActionQueueType LinkedList $ActionResumeRetryCount -1 ``` My time stamp in audit log is `Jan 11 08:02:20` year is not present. ```auto { "@timestamp" => 2024-01-11T08:02:20.000Z, "facility" => 1, "severity_label" => "Notice", "priority" => 13, "timestamp" => "Jan 11 08:02:20", "host" => "172.35.63.35", "facility_label" => "user-level", "logsource" => "ip-172-35-63-35.ec2.internal", "@version" => "1", "message" => "\"172.35.63.35:0\", \"DDL\", \"ONE\", \"newyeartest2\", \"mykeyspace\", \"CREATE TABLE newyeartest2 (a int,b int,c int,PRIMARY KEY (a, b, c))\", \"152.59.69.211:0\", \"cassandra\", \"false\"", "severity" => 5, "type" => "db" } ``` ---
**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\ **Post date:** [January 16, 2024, 1:27pm UTC](https://discuss.elastic.co/t/my-timestamp-in-audit-log-using-syslog-input-plugin-not-in-correct-format/351127/2 "2024-01-16T13:27:15Z")
HI, you can use the `date` filter in Logstash to parse the timestamp and add the current year to it. Here is an example of how you can do this: ```auto filter { if [type] == "scylladb" { grok { match => {"message" => "%{IP:server_ip}:%{DATA:server_port},\s%{DATA:category},\s%{DATA:consistency},\s%{DATA:table_name},\s%{DATA:keyspace_name},\s%{GREEDYDATA:operation},\s%{DATA:source}:%{DATA:source_port},\s%{DATA:username},\s%{GREEDYDATA:error}"} } if "_grokparsefailure" in [tags] { drop{} } date { match => ["timestamp", "MMM dd HH:mm:ss"] target => "@timestamp" } } } ``` In this configuration, the `date` filter is used to parse the `timestamp` field (which should be in the format "MMM dd HH:mm:ss") and store the result in the `@timestamp` field. The `date` filter will automatically add the current year to the timestamp. Regards ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 16, 2024, 2:31pm UTC](https://discuss.elastic.co/t/my-timestamp-in-audit-log-using-syslog-input-plugin-not-in-correct-format/351127/3 "2024-01-16T14:31:44Z")
> [@yago82](#): > > The `date` filter will automatically add the current year to the timestamp. Except when it doesn't. See [here](https://github.com/logstash-plugins/logstash-filter-date/issues/137), [here](https://github.com/logstash-plugins/logstash-filter-date/issues/100), and [here](https://github.com/logstash-plugins/logstash-filter-date/issues/51). It's non-trivial. ---
**Author:** ![Subrato1](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@Subrato1](https://discuss.elastic.co/u/Subrato1)\ **Post date:** [January 17, 2024, 7:57am UTC](https://discuss.elastic.co/t/my-timestamp-in-audit-log-using-syslog-input-plugin-not-in-correct-format/351127/4 "2024-01-17T07:57:21Z")
Still the same ```auto { "timestamp" => "Jan 17 07:55:43", "host" => "172.31.63.35", "category" => "\"AUTH\"", "severity" => 5, "consistency" => "\"\"", "message" => "\"172.31.63.35:0\", \"AUTH\", \"\", \"\", \"\", \"\", \"127.0.0.1:0\", \"cassandra\", \"false\"", "severity_label" => "Notice", "username" => "\"cassandra\"", "logsource" => "ip-172-31-63-35.ec2.internal", "table_name" => "\"\"", "operation" => "\"\"", "server_port" => "0\"", "program" => "scylla-audit", "facility" => 1, "facility_label" => "user-level", "error" => "\"false\"", "type" => "scylladb", "@timestamp" => 2024-01-17T07:55:43.000Z, "priority" => 13, "@version" => "1", "server_ip" => "172.31.63.35", "keyspace_name" => "\"\"", "source" => "\"127.0.0.1", "source_port" => "0\"" } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 17, 2024, 7:09pm UTC](https://discuss.elastic.co/t/my-timestamp-in-audit-log-using-syslog-input-plugin-not-in-correct-format/351127/5 "2024-01-17T19:09:29Z")
> [@Subrato1](#): > > ```auto > "timestamp" => "Jan 17 07:55:43", > "@timestamp" => 2024-01-17T07:55:43.000Z, > > ``` Looks good to me. The date filter has added the current year. What is your issue with this result? ---
**Author:** ![Subrato1](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@Subrato1](https://discuss.elastic.co/u/Subrato1)\ **Post date:** [January 18, 2024, 12:27pm UTC](https://discuss.elastic.co/t/my-timestamp-in-audit-log-using-syslog-input-plugin-not-in-correct-format/351127/6 "2024-01-18T12:27:01Z")
It was already there no change please check my previous log ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [January 18, 2024, 12:31pm UTC](https://discuss.elastic.co/t/my-timestamp-in-audit-log-using-syslog-input-plugin-not-in-correct-format/351127/7 "2024-01-18T12:31:29Z")
> [@Subrato1](#): > > It was already there no change please check my previous log It is not clear what is your issue, what you are trying to do and what is not working. The `timestamp` field comes from your log, it comes already without the year, Logstash will not change it. ---
**Author:** ![Subrato1](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@Subrato1](https://discuss.elastic.co/u/Subrato1)\ **Post date:** [January 18, 2024, 12:36pm UTC](https://discuss.elastic.co/t/my-timestamp-in-audit-log-using-syslog-input-plugin-not-in-correct-format/351127/8 "2024-01-18T12:36:06Z")
I want to fetch Year from `@timestamp` field and want to add it to `timestamp` field. Is it possible? Or any other way to add the current year to `timestamp` field ---
**Author:** ![Subrato1](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@Subrato1](https://discuss.elastic.co/u/Subrato1)\ **Post date:** [January 19, 2024, 5:04am UTC](https://discuss.elastic.co/t/my-timestamp-in-audit-log-using-syslog-input-plugin-not-in-correct-format/351127/9 "2024-01-19T05:04:32Z")
```auto ruby { code => " event.set('current_year', Time.now.utc.year) " } mutate { convert => { "current_year" => "string" } } ruby { code => " event.set('demotimestamp', event.get('current_year') + ' ' + event.get('timestamp')) " } mutate { remove_field => ["timestamp","current_year"] } mutate { rename => { "demotimestamp" => "timestamp" } } ``` I added this and now I am able to fetch current UTC year using `Time.now.utc.year` and add it to my timestamp field. Result: `"timestamp" => "2024 Jan 19 04:24:00"` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 19, 2024, 7:07pm UTC](https://discuss.elastic.co/t/my-timestamp-in-audit-log-using-syslog-input-plugin-not-in-correct-format/351127/10 "2024-01-19T19:07:22Z")
I am not speaking to your use case, but in general adding the current year is not what you want. The date filter has [heuristics](https://discuss.elastic.co/t/add-date-and-seconds-to-odd-iso-8601-ish-timestamp/288031/2) to [guess](https://github.com/logstash-plugins/logstash-filter-date/blob/d0ed7e3f2fd05ca6e4d32b5d4d89ddf1b6dcb2cb/src/main/java/org/logstash/filters/parser/JodaParser.java#L97) what year is applicable, but there will always be exceptions where that goes wrong. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 16, 2024, 7:08pm UTC](https://discuss.elastic.co/t/my-timestamp-in-audit-log-using-syslog-input-plugin-not-in-correct-format/351127/11 "2024-02-16T19:08:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.