I wanted to make sure I’m using macros.past_$m correctly. The documentation has the following example:
%syslog.timestamp >= %macros.past_5m
Which I interpret to mean the syslog.timestamp is greater than, or equal to, five minutes old. If the test is for an event within the last five minutes, wouldn’t the following make more sense?
The way I interpret the first one is it will match if the timestamp is older (greater than),or equal to, five minutes. While the second will match if the timestamp is newer than (less than), or equal to, five minutes. Is that not correct?