Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

Question About Custom Logs Time Field

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Question About Custom Logs Time Field

L1 Bithead

Question

I want to replace _time field value with original timestamp, but I can not find way to do this. 
Please tell me how to replace _time field value or Is this not possible due to specifications?

Background

When we collect logs from XDR Collector, which ingest three fields which related time.

First one is _time, which is generated by XDR Collector.

Second is _insert_time, which is generated by Cortex XDR.

Last one is original timestamp which recorded in log ( which included _raw_log or single dedicate field using parsing rule or filebeat setting)

 

For example, if I ingest apache http severlog, then it shows like this.

HFukuda_0-1725412582774.png

Between _time and datetime(which was created by parsing rule from _raw_log field), there are some gaps around 1 to 10 seconds.
I want to erase these gaps.

 

3 REPLIES 3

L5 Sessionator

Hi @H.Fukuda, thanks for reaching us using the Live Community.

 

The _time fields is a system field that takes the value from the data entry's timestamp. If unknown, then the value is the time the data entry was added to the database. In your case you have a timestamp value in the logs, and looks like is accurate. 

Is your "datetime" field rounding to zero the seconds?

JM

Hi Jmazzeo,

>Is your "datetime" field rounding to zero the seconds?

No.

To show the gap, I build apache server, and  generate log with using shell script which generate log each 10 seconds.

So original datetime field's seconds data will be zero. 

L1 Bithead

paIoaItonetworks_0-1725970479874.png

Unfortunately, these fields will always be shown

  • 498 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!