<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Use provided timestamp as event time in VMware Aria Operations for Logs Discussions</title>
    <link>https://communities.vmware.com/t5/VMware-Aria-Operations-for-Logs/Use-provided-timestamp-as-event-time/m-p/529923#M405</link>
    <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;P&gt;&lt;SPAN style="font-size: 12pt;"&gt;Hi,&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN style="text-align: left; color: rgba(0, 0, 0, 0.87); text-transform: none; text-indent: 0px; letter-spacing: normal; font-family: 'Roboto',arial,sans-serif; font-size: 12pt; font-style: normal; font-variant: normal; font-weight: 400; text-decoration: none; word-spacing: 0px; display: inline !important; white-space: pre-wrap; orphans: 2; float: none; -webkit-text-stroke-width: 0px; background-color: transparent;"&gt;LucD has published many articles in his blog related to this topic, here is the link:&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN style="font-size: 12pt;"&gt;&lt;A href="http://www.lucd.info/2016/04/29/loginsight-module/" title="http://www.lucd.info/2016/04/29/loginsight-module/"&gt;LogInsight Module - LucD notes&lt;/A&gt; &lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;----&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Other link: &lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;A href="https://vmw-loginsight.github.io/#Getting-started-with-the-Log-Insight-REST-API" title="https://vmw-loginsight.github.io/#Getting-started-with-the-Log-Insight-REST-API"&gt;Log Insight API documentation&lt;/A&gt; &lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN style="font-size: 12pt;"&gt;ARomeo&lt;/SPAN&gt;&lt;/P&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
    <pubDate>Wed, 22 Jan 2020 15:38:08 GMT</pubDate>
    <dc:creator>Alex_Romeo</dc:creator>
    <dc:date>2020-01-22T15:38:08Z</dc:date>
    <item>
      <title>Use provided timestamp as event time</title>
      <link>https://communities.vmware.com/t5/VMware-Aria-Operations-for-Logs/Use-provided-timestamp-as-event-time/m-p/529922#M404</link>
      <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;P&gt;Hello,&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;I'm sending logs to logInsight and want the event time to use the provided timestamp.&lt;/P&gt;&lt;P&gt;Example :&lt;/P&gt;&lt;P&gt;timestamp=22-01-2020 15:12:53;template=;dataid=&lt;SPAN class="messagefield" data-displayname="dataid" data-internalname="dataid"&gt;StoreHeader:storeId:11708&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN class="messagefield" data-displayname="dataid" data-internalname="dataid"&gt;timestamp=22-01-2020 15:12:53;template=;dataid=&lt;SPAN class="messagefield" data-displayname="dataid" data-internalname="dataid"&gt;StoreHeader:storeId:11101&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN class="messagefield" data-displayname="dataid" data-internalname="dataid"&gt;&lt;SPAN class="messagefield" data-displayname="dataid" data-internalname="dataid"&gt;The parsing is correct but the event time does not use the provided timestamp but the time when the log data is processed by the agent..&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN class="messagefield" data-displayname="dataid" data-internalname="dataid"&gt;&lt;SPAN class="messagefield" data-displayname="dataid" data-internalname="dataid"&gt;&lt;span class="lia-inline-image-display-wrapper" image-alt="pastedImage_0.png"&gt;&lt;img src="https://communities.vmware.com/t5/image/serverpage/image-id/16791iA23D13902D451AA2/image-size/large?v=v2&amp;amp;px=999" role="button" title="pastedImage_0.png" alt="pastedImage_0.png" /&gt;&lt;/span&gt;&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN class="messagefield" data-displayname="dataid" data-internalname="dataid"&gt;What's the correct way to have LogInsigh using the provided timestamp ?&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN class="messagefield" data-displayname="dataid" data-internalname="dataid"&gt;Used parser: &lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;EM&gt;[parser|CacheivlParser]&lt;/EM&gt;&lt;/P&gt;&lt;P&gt;&lt;EM&gt;base_parser=kvp&lt;/EM&gt;&lt;/P&gt;&lt;P&gt;&lt;EM&gt;fields=*&lt;/EM&gt;&lt;/P&gt;&lt;P&gt;&lt;EM&gt;delimiter=";"&lt;/EM&gt;&lt;/P&gt;&lt;P&gt;&lt;EM&gt;debug=yes&lt;/EM&gt;&lt;/P&gt;&lt;P&gt;&lt;EM&gt;field_decoder={"timestamp": "TableSize_tsp_parser"}&lt;/EM&gt;&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;EM&gt;[parser|TableSize_tsp_parser]&lt;/EM&gt;&lt;/P&gt;&lt;P&gt;&lt;EM&gt;base_parser=timestamp&lt;/EM&gt;&lt;/P&gt;&lt;P&gt;&lt;EM&gt;debug=no&lt;/EM&gt;&lt;/P&gt;&lt;P&gt;&lt;EM&gt;format=%d-%m-%Y %H:%M:%S&lt;/EM&gt;&lt;/P&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
      <pubDate>Wed, 22 Jan 2020 15:20:11 GMT</pubDate>
      <guid>https://communities.vmware.com/t5/VMware-Aria-Operations-for-Logs/Use-provided-timestamp-as-event-time/m-p/529922#M404</guid>
      <dc:creator>ahcen</dc:creator>
      <dc:date>2020-01-22T15:20:11Z</dc:date>
    </item>
    <item>
      <title>Re: Use provided timestamp as event time</title>
      <link>https://communities.vmware.com/t5/VMware-Aria-Operations-for-Logs/Use-provided-timestamp-as-event-time/m-p/529923#M405</link>
      <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;P&gt;&lt;SPAN style="font-size: 12pt;"&gt;Hi,&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN style="text-align: left; color: rgba(0, 0, 0, 0.87); text-transform: none; text-indent: 0px; letter-spacing: normal; font-family: 'Roboto',arial,sans-serif; font-size: 12pt; font-style: normal; font-variant: normal; font-weight: 400; text-decoration: none; word-spacing: 0px; display: inline !important; white-space: pre-wrap; orphans: 2; float: none; -webkit-text-stroke-width: 0px; background-color: transparent;"&gt;LucD has published many articles in his blog related to this topic, here is the link:&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN style="font-size: 12pt;"&gt;&lt;A href="http://www.lucd.info/2016/04/29/loginsight-module/" title="http://www.lucd.info/2016/04/29/loginsight-module/"&gt;LogInsight Module - LucD notes&lt;/A&gt; &lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;----&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Other link: &lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;A href="https://vmw-loginsight.github.io/#Getting-started-with-the-Log-Insight-REST-API" title="https://vmw-loginsight.github.io/#Getting-started-with-the-Log-Insight-REST-API"&gt;Log Insight API documentation&lt;/A&gt; &lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN style="font-size: 12pt;"&gt;ARomeo&lt;/SPAN&gt;&lt;/P&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
      <pubDate>Wed, 22 Jan 2020 15:38:08 GMT</pubDate>
      <guid>https://communities.vmware.com/t5/VMware-Aria-Operations-for-Logs/Use-provided-timestamp-as-event-time/m-p/529923#M405</guid>
      <dc:creator>Alex_Romeo</dc:creator>
      <dc:date>2020-01-22T15:38:08Z</dc:date>
    </item>
  </channel>
</rss>

