document dateparser-enrich (#160)

crowdsecurity · Feb 25, 2021 · d140b4d · d140b4d
1 parent fa6c589
commit d140b4d
Showing 1 changed file with 17 additions and 2 deletions.
diff --git a/parsers/s02-enrich/crowdsecurity/dateparse-enrich.md b/parsers/s02-enrich/crowdsecurity/dateparse-enrich.md
@@ -1,2 +1,17 @@
-Parses time in logs and alter the event time.
-It is mandatory when using crowdwatch with 'cold' logs.
+Parses timestamp strings in logs to be used in [forensic mode](https://doc.crowdsec.net/Crowdsec/v1/user_guide/forensic_mode/). The following formats are currently supported :
+
+ - RFC3339
+ - `02/Jan/2006:15:04:05 -0700`
+ - `Mon Jan 2 15:04:05 2006`
+ - `02-Jan-2006 15:04:05 europe/paris`
+ - `01/02/2006 15:04:05`
+ - `2006-01-02 15:04:05.999999999 -0700 MST`
+ - `Jan  2 15:04:05`
+ - `Mon Jan 02 15:04:05.000000 2006`
+ - `2006-01-02T15:04:05Z07:00`
+ - `2006/01/02`
+ - `2006/01/02 15:04`
+ - `2006-01-02`
+ - `2006-01-02 15:04`
+
+The `StrTime` item of the event is parsed by default. See [crowdsecurity/syslog-logs](https://hub.crowdsec.net/author/crowdsecurity/configurations/syslog-logs) as an example of a parser setting this field for `crowdsecurity/dateparse-enrich`.