Ingesting last year's syslog loglines will use this year's year since syslog format doesn't have a year in it (SYSLOGTIMESTAMP %{MONTH} +%{MONTHDAY} %{TIME}
). I'm reading in the syslog lines from the file input and am still playing around with ES config, so I'm constantly DELETEing indexes, so I need to keep re-importing. This isn't a production-style solution.
I'm currently processing the timestamp pulled out with the syslog pattern using the date filter
date {
match => [ "timestamp", "MMM dd HH:mm:ss",
"MMM d HH:mm:ss"]
timezone => "Etc/UTC"
}
If the @timestamp
field is > now, subtract 1 year from it. Our syslog is always in Etc/UTC
so I just blindly reassign it to -00:00
.