Time Adjustment

Not a device parser but a fix for the single most common ingest problem: a source sending local time where the platform expects UTC, which lands its events outside the window you search. The script stamps the collector name onto every record, then shifts @timestamp by the offset of a named timezone for the collectors or sources you list, and returns abort so the record carries on to the device parser behind it. Edit the collector names, source names and timezone before using it — the values below are placeholders, and the generic block at the end is commented out on purpose. See Time for timezoneOffset and the other time functions.

The Parser

// Description:
// Reads / converts @timestamp from Server syslog as Local instead of UTC

// Data input format: ({ obj, size, source }) or ( doc )
function main({obj, size, source}) {

    if (source && source != "" ) {
        obj["@collector"] = source
    } else {
        obj["@collector"] = "local" // server side syslog collector ('local')
    }

    let ts = obj["@timestamp"]
    if (!ts) {
        return { status: "error" }
    }
    
    // Adjust timestamp based on Fluency Collector name
    if (obj["@collector"] == "collector-name" || obj["@collector"] == "cname-2") {
        let TZ = "America/New_York"
        let offset = timezoneOffset(TZ)
        // obj["@timestamp"] = ts - offset * 1000
    }

    // Adjust timestamp based on Syslog '@source' name
    if (obj["@source"] == "remote" || obj["@source"] == "balance-6a00") {
        let TZ = "America/New_York"
        let offset = timezoneOffset(TZ)
        obj["@timestamp"] = ts - offset * 1000
        return { status: "abort" }
    }

    // Generic timestamp adjustment logic
    let TZ = "America/New_York"
    // let offset = timezoneOffset(TZ)
    // obj["@timestamp"] = ts - offset * 1000

    return { status: "abort" } // continue to next parser
}