We have a syslog data that was written to disk via the FULLDATE
macro. For today, it looks like — 2019 Apr 3 19:30:01
with double space. I assume that it would be 2019 Apr 13 19:30:01
in ten days with only one space.
I wonder which format to use in props.conf -
TIME_FORMAT=%Y %b %d %H:%M:%S
works fine for 2019 Apr 3 19:30:01
but not for 2019 Apr 13 19:30:01
, which is counter intuitive to me.
On Unix, I see -
date "+%Y %b %d %H:%M:%S"
as 2019 Apr 03 15:45:41
. Apparently space and zero are interchangeable.
Any ideas?
This warning threw me off ; -)
It seems that it was my bad - it works just fine.