Set syslog event time

microsoft · Jul 12, 2016 · 1672100 · 1672100
1 parent b52215e
commit 1672100
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/source/code/plugins/filter_syslog.rb b/source/code/plugins/filter_syslog.rb
@@ -30,6 +30,7 @@ def filter(tag, time, record)
       # Use Time.now, because it is the only way to get subsecond precision in version 0.12.
       # The time may be slightly in the future from the ingestion time.
       record["Timestamp"] = OMS::Common.format_time(Time.now.to_f)
+      record["EventTime"] = OMS::Common.format_time(time)
       hostname = record["host"]
       record["Host"] = hostname
       record.delete "host"

diff --git a/source/code/plugins/filter_syslog_security.rb b/source/code/plugins/filter_syslog_security.rb
@@ -35,6 +35,7 @@ def filter(tag, time, record)
       # Use Time.now, because it is the only way to get subsecond precision in version 0.12.
       # The time may be slightly in the future from the ingestion time.
       record['Timestamp'] = OMS::Common.format_time(Time.now.to_f)
+      record['EventTime'] = OMS::Common.format_time(time)
 
       record['Message'] = record['message']
       record.delete 'message'