I’ve tried to configure the logparser plugin in order to parse my existing postfix mail.log.
Using Grok pattern I manage successfully to integrate the logs into influxdb but I have a problem for the timestamp.
I’m catching the log timestamp by using the %{SYSLOGTIMESTAMP} Grok pattern; which is actually working, but when converting it in order to replace the time into influxdb Telegraf doesn’t manage to convert it.
I think it’s do to the lack of year as the SYSLOGTIMESTAMP is the following format :
Sep 25 08:27:29
As per the documentation, I’ve tried several combination of custom timestamp modifiers without success.
The first problem I notice is that you need to use the exact magic “reference time”: Mon Jan 2 15:04:05 MST 2006 when using a custom timestamp string: %{SYSLOGTIMESTAMP:timestamp:ts-“Jan 02 15:04:05”
I tried this and ran into another problem, since there is no year in this pattern the timestamp is set to year 0. The Go standard library puts it like this:
Elements omitted from the value are assumed to be zero or, when zero is impossible, one, so parsing “3:04pm” returns the time corresponding to Jan 1, year 0, 15:04:00 UTC (note that because the year is 0, this time is before the zero Time). Years must be in the range 0000…9999. The day of the week is checked for syntax but it is otherwise ignored.
Perhaps we could have Telegraf fill in the current year if it is not set, or add a way to manually specify missing parts like we have for timezone. Could you open a new issue about this?
