Merge pull request #261 from splunk/fix/zscaler

Add timestamp parsing to zscaler log path
CSVD · Jan 7, 2020 · f860d79 · f860d79
2 parents 277b928 + 51b6e6e
commit f860d79
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/package/etc/conf.d/log_paths/p_rfc3164-zscaler_nss.conf.tmpl b/package/etc/conf.d/log_paths/p_rfc3164-zscaler_nss.conf.tmpl
@@ -12,6 +12,7 @@ log {
     source (s_ZSCALER_NSS);
 {{- end }}
 
+    parser { date-parser(format("%Y-%m-%d %H:%M:%S") template('$(substr "$LEGACY_MSGHDR$MSG" "0" "19")')); };
     rewrite {
         set("zscaler_nss", value("fields.sc4s_vendor_product"));
         subst("^[^\t]+\t", "", value("MESSAGE"), flags("global"));