Added addtional date parsing for SWG formats

Cargill · Aug 19, 2024 · 548878d · 548878d
1 parent 561a2a8
commit 548878d
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/config/processors/syslog_security_skyhigh.swg.conf b/config/processors/syslog_security_skyhigh.swg.conf
@@ -157,7 +157,7 @@ if [tmp_csv] !~ "\w,\w" {
     date {
       # "26/aug/2020:19:35:09.533 +0000"
       # ts=[12/oct/2020:17:24:01 +0000]
-      match => ["[event][created]", "ISO8601","MMM dd HH:mm:ss","dd/MMM/yyyy:HH:mm:ss ZZ"  ]
+      match => ["[event][created]", "ISO8601" , "dd/MMM/yyyy:HH:mm:ss Z", "MMM dd HH:mm:ss","dd/MMM/yyyy:HH:mm:ss ZZ" ]
       timezone => "GMT"
       locale => "en"
       target => "[event][created]"