From 3a2da357aed79a86cfd037897297f6e15959d341 Mon Sep 17 00:00:00 2001 From: Mark Bonsack Date: Thu, 13 Feb 2020 22:34:57 -0800 Subject: [PATCH] Update comment on TZ parser * Update comment on TZ parser --- package/etc/conf.d/log_paths/lp-fortinet_fortiweb.conf.tmpl | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/package/etc/conf.d/log_paths/lp-fortinet_fortiweb.conf.tmpl b/package/etc/conf.d/log_paths/lp-fortinet_fortiweb.conf.tmpl index bf3bb74..564f4d9 100644 --- a/package/etc/conf.d/log_paths/lp-fortinet_fortiweb.conf.tmpl +++ b/package/etc/conf.d/log_paths/lp-fortinet_fortiweb.conf.tmpl @@ -25,13 +25,15 @@ log { kv-parser(prefix(".kv.") pair-separator(",") template("${MSGHDR} ${MSG}")); }; +# Fetch timezone from timezone nv pair and parse unique format (no zero padding, e.g. "-8:00" rather than "-08:00" +# Reformat to "-0800" rewrite { subst('.*([\+-]\d+:\d+).*', $1, value(".kv.timezone")); subst('([\+-])(\d)(?=:):(\d+)', "${1}0${2}${3}", value(".kv.timezone")); subst('([\+-])(\d+):(\d+)', "$1$2$3", value(".kv.timezone")); }; - #2020-02-12,23:13:33 + #2020-02-12,23:13:33-0800 #parse the date parser { date-parser(