in_kmsg: align fields with syslog input plugin

- a syslog like timestamp can be very human friendly for kernel
  messages, instead of only having monotonic timestamp
- if we want to write both the kernel logs and system logs to
  /var/log/messages then we don't have to use separate templates

Signed-off-by: Mohd Husaam Mehdi <[email protected]>

Author: mhusaam

plugins/in_kmsg/in_kmsg.c

@@ -165,6 +165,15 @@ static inline int process_line(const char *line,
 
     flb_time_set(&ts, ctx->boot_time.tv_sec + tv.tv_sec, tv.tv_usec * 1000);
 
+    /* Format syslog timestamp: "Jul 03 10:31:53" */
+    time_t real_time = ctx->boot_time.tv_sec + tv.tv_sec;
+    struct tm tm_info;
+    char syslog_ts[32];
+
+    localtime_r(&real_time, &tm_info);
+    strftime(syslog_ts, sizeof(syslog_ts), "%b %d %H:%M:%S", &tm_info);
+    int syslog_ts_len = strlen(syslog_ts);
+
     /* Now process the human readable message */
     p = strchr(p, ';');
     if (!p) {
@@ -198,7 +207,10 @@ static inline int process_line(const char *line,
                 FLB_LOG_EVENT_UINT64_VALUE(tv.tv_usec),
 
                 FLB_LOG_EVENT_CSTRING_VALUE("msg"),
-                FLB_LOG_EVENT_STRING_VALUE((char *) p, line_len - 1));
+                FLB_LOG_EVENT_STRING_VALUE((char *) p, line_len - 1),
+
+                FLB_LOG_EVENT_CSTRING_VALUE("syslog_ts"),
+                FLB_LOG_EVENT_STRING_VALUE(syslog_ts, syslog_ts_len));
     }
 
     if (ret == FLB_EVENT_ENCODER_SUCCESS) {