Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Time format not handled properly #2792

Closed
herangstl opened this issue Nov 20, 2020 · 2 comments
Closed

Time format not handled properly #2792

herangstl opened this issue Nov 20, 2020 · 2 comments
Assignees
Labels

Comments

@herangstl
Copy link

herangstl commented Nov 20, 2020

I use Fluent Bit (v1.6.3) -> Gelf -> Graylog

Depending on the time of year, the timestamps from my logfiles are off by 1 or 2 hours in Graylog.

On my machines, the output of

date +"%Z %z"

shows in winter: CET +0100
and in summer: CEST +0200

/etc/timezone is set to "Europe/Berlin"

My logfiles look like this:

2020-11-20 12:20:46,788	INFO 	[pool-4-thread-1]	[user.name.id=ffb2c7919e746423]

This "12:20:46,788" ends up as "13:20:46,788" in Graylog (Elasticsearch).

The relevant part of my Fluent Bit configuration:

[PARSER]
    Name p_multiline
    Format regex
    Regex ^(?<timestamp>20\d{2}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3})\s+(?<level>[^\s]+)\s+\[(?<thread>[^\t\n]*)\]\s+\[(?<pro_properties>[^\t\n]*)\]\s+(?<full_message>.*)

[PARSER]
    Name p_extract_timestamp
    Format regex
    Regex ^(?<time>.*)
    Time_Key time
    Time_Format %Y-%m-%d %H:%M:%S,%L

As a workaround I added "Time_Offset +0200" in summer and "Time_Offset +0100" in winter - but this means I have to change all my Fluent Bit configurations two times a year on all my hosts, which is a pita.

It seems Fluent Bit always assumes timestamps are in UTC - and does not care about the machines timezone. Imho it would be better if Fluent Bit would assume: "timezone in logfile = timezone of host machine".

After reading #2388 I was hoping this is fixed now - but it seems its not. I am using v1.6.3.

@fujimotos fujimotos self-assigned this Nov 24, 2020
@github-actions
Copy link
Contributor

github-actions bot commented Mar 6, 2021

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

@github-actions github-actions bot added the Stale label Mar 6, 2021
@github-actions
Copy link
Contributor

This issue was closed because it has been stalled for 5 days with no activity.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants