add time from nsg log to splunk event metadata (#14)
* add raw channel identifier * debug channel id * debug raw channel * switch to debug logging * add time to splunk event, remove new header * add fractions of second to time format * time format. * add fractional seconds to time * 24 hour clock * remove raw channel mod, switch back to information logging.
This commit is contained in:
Родитель
91db763175
Коммит
2e21dfa55d
|
@ -10,14 +10,25 @@ using Microsoft.CodeAnalysis.Formatting;
|
|||
class SplunkEventMessage
|
||||
{
|
||||
public string sourcetype { get; set; }
|
||||
public double time { get; set; }
|
||||
public DenormalizedRecord @event { get; set; }
|
||||
|
||||
public SplunkEventMessage (DenormalizedRecord splunkEvent)
|
||||
{
|
||||
sourcetype = "amdl:nsg:flowlogs";
|
||||
time = unixTime(splunkEvent.time);
|
||||
@event = splunkEvent;
|
||||
}
|
||||
|
||||
double unixTime(string time)
|
||||
{
|
||||
DateTime t = DateTime.ParseExact(time,"yyyy-MM-ddTHH:mm:ss.fffffffZ", System.Globalization.CultureInfo.InvariantCulture);
|
||||
|
||||
double unixTimestamp = t.Ticks - new DateTime(1970, 1, 1).Ticks;
|
||||
unixTimestamp /= TimeSpan.TicksPerSecond;
|
||||
return unixTimestamp;
|
||||
}
|
||||
|
||||
public int GetSizeOfObject()
|
||||
{
|
||||
return sourcetype.Length + 10 + 6 + (@event == null ? 0 : @event.GetSizeOfJSONObject());
|
||||
|
|
Загрузка…
Ссылка в новой задаче