Rewrite Timestamps to RFC5424
A bundle of processors for rewriting a syslog message's rfc3164 timestamp into rfc5424 format.
Included Processors
1
Parse Regex
Parses the log body into three attributes: 'pre_ts', 'timestamp', and 'post_ts'. The 'timestamp' field is now available for further parsing into the time field.
2
Parse Timestamp
Converts the extracted timestamp string into a proper timestamp format. This processor takes the 'timestamp' field and converts it into a valid timestamp in the log body.
3
Rewrite Timestamp
Rewrites the timestamp in the log body to a new format. This processor takes the 'time' field and rewrites it to a new format, which is now in syslog rfc5424 format.
4
Concatenate Fields
Concatenates the 'pre_ts', 'timestamp', and 'post_ts' fields into a single log body field.
Example Telemetry
Log
| Name | Before | After |
|---|---|---|
| observed_time | 2026-01-02T20:45:00Z | 2026-01-02T20:45:00Z |
| time | 2026-01-02T20:45:00Z | 2026-01-02T14:30:00Z |
| severity_text | INFO | INFO |
| severity_number | 9 | 9 |
Body
<14>Jan 02 14:30:00 myhost sshd[1234]: Accepted publickey for user from 192.168.1.100 port 22<14> 2026-01-02T14:30:00Z myhost sshd[1234]: Accepted publickey for user from 192.168.1.100 port 22Resource
| Name | Before | After |
|---|---|---|
| host.name | syslog-server-01 | syslog-server-01 |
| service.name | syslog-receiver | syslog-receiver |