select another timestamp key about seq-input-gelf HOT 2 OPEN

Sorry for the slow reply here @yanzixiang!

GELF requires the timestamp to be seconds since the epoch, with millisecond precision following a decimal point. It looks like maybe you're ending up with that microseconds-since-epoch value in your GELF message, which is then overflowing in this server because it's trying to treat them as seconds.

We definitely shouldn't ever panic on any input, so I've opened #113 to not overflow when encountering very large timestamp values.

This library doesn't do a lot of transformation itself, but one option you could consider if you want more control over how those journald events are emitted is using a log processing pipeline like Fluent Bit, which has a Systemd input, and can output directly to Seq with very little configuration.

from seq-input-gelf.

GELF requires the timestamp to be seconds since the epoch, with millisecond precision following a decimal point. It looks like maybe you're ending up with that microseconds-since-epoch value in your GELF message, which is then overflowing in this server because it's trying to treat them as seconds.

so, the timestamp should be string "1665628250.123" ?
i have try this string, but it fails too...

This library doesn't do a lot of transformation itself, but one option you could consider if you want more control over how those journald events are emitted is using a log processing pipeline like Fluent Bit, which has a Systemd input, and can output directly to Seq with very little configuration.

my device and the seq server is not always connected,
i want to sync all systemd's log entrys to seq,
so i thinks i can NOT use Fluent Bit to do this.

from seq-input-gelf.