Convert french string date to timestamp

Graylog Central (peer support)
1

Hi all,

I’m found out that one of the application log file use french date pattern like this : mar. mars 6 12:00:00 UTC 2018.
So I succeeded to convert most of the date with extractor and converter except for the month… so I can have only a timestamp like this : 2018-01-06T12:00:00
I can’t find a way to convert the string “mars” to something usable (mars/march, avril/april, juin/june, juillet/july, etc.).
Is there any way to extract the date or convert it into new field and extract it afterward?

thx by advance,

Arnaud

2

You can use the parse_date() with the locale fr for correcting the date/time of the message.

And the obligatory note: timestamps in log files should follow ISO 8601.

3

Thanks Jochen,

We are running the 2.2 graylog version on our operational plateform. I see that in this version there is no way to specify the language.
Is there any solution or workaround to make it work on 2.2 version?

Best regards,

Arnaud

4

No. You’ll have to upgrade or create your own backport of the respective functionality.

5

Ok, so do you mean that I can do it only by using pipelines or provided tools? or do I have to code something beside? Because I can’t upgrade graylog at the moment even if I wish…

6

You would have to create a back-port of the new code for the parse_date() function from Graylog 2.4.3 into Graylog 2.2.x and build your own version of the Graylog Pipeline Processor plugin to use with your version of Graylog.

7

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.