Question
How does a worker’s syslog input convert the timestamp in the _raw field to epoch time in _time field?
Environment
- Cribl Stream
- Syslog Input
- Timestamp
Answer
When a syslog event is ingested at a worker’s syslog input, the input’s breaker will parse the event’s _raw field for a timestamp, based upon recognized patterns, and create a _time field that uses epoch time standards.
If the pattern in the event’s _raw field contains a timezone identifier or offset (e.g. Z or +TT:TT) then the input will create an epoch timestamp that reflects a calculation to UTC from the identified event timezone identifier or offset.
If no timezone identifier or offset is provided in the event, then the input will adjust based upon either the worker’s host’s local timezone or a hard-coded timezone specified in the input’s settings.
By default, the syslog input is configured to use a worker’s host’s local time and then calculate an offset to epoch time. For example, if the worker’s host’s timezone is PDT (UTC -7), and the timestamp in the raw is June 27th, 2025 13:00 - then _time field will be populated with the epoch representation of June 27th, 2025 20:00 (1751054400).
Users can configure a syslog input to presume a specific timezone for offset. For example, if the sylog input assumes a timezone of EDT (UTC -4) and the timestamp in the _raw field is June 27th, 2025 13:00 - then the _time field will be populated with the epoch representation of June 27th, 2025 17:00 (1751043600).