timestamp

[alan-taylor]

Hello,

I am writing a custom format to handle pfSense logs, which is going ok.
However, I suspect I am being dense about timestamps:

Writing an SQL query to include the timestamp, lnav complains that there is "no such column", while the "Known message fields" display above is showing a "timestamp" field ? (pic attached)

Snippet from the .json file (timestamp is the same elsewhere):
"regex": {
"IPv4-1": {
"pattern": "^(?(?:[a-zA-z]{3,} +\d{1,2} \d{2}:\d{2}:\d{2})?) etc."
},
Sample timestamp is: Mar 18 10:51:53

BRgds/Alan

[tstack]

Short answer: Use log_time to access the log message timestamp in SQL.

Longer answer: Some of the standard fields, like the timestamp and message body, are mapped to the same names for every log format (log_time and log_body in this case). Sorry, I need to make this more clear in the docs and the overlay.

[alan-taylor]

Thank you Tim, problem solved ...
:)