Add timestamp parsing to zscaler log path

* Add missing timestamp parsing to zscaler log path
CSVD · Jan 4, 2020 · 51b6e6e · 51b6e6e
1 parent 277b928
commit 51b6e6e
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/package/etc/conf.d/log_paths/p_rfc3164-zscaler_nss.conf.tmpl b/package/etc/conf.d/log_paths/p_rfc3164-zscaler_nss.conf.tmpl
@@ -12,6 +12,7 @@ log {
     source (s_ZSCALER_NSS);
 {{- end }}
 
+    parser { date-parser(format("%Y-%m-%d %H:%M:%S") template('$(substr "$LEGACY_MSGHDR$MSG" "0" "19")')); };
     rewrite {
         set("zscaler_nss", value("fields.sc4s_vendor_product"));
         subst("^[^\t]+\t", "", value("MESSAGE"), flags("global"));