timestamp processing script (/etc/logwatch/scripts/shared/sqfullstampanywhere)
This is basically a modified version of the 'applyeurodate' script that comes with Logwatch. It had to be modified to search within [square brackets] and to accept characters coming before the stamp (i.e. ANSI colour codes). If you change the 'stamp' variable in the backup script to update the timestamp to your liking (which to totally fine!) then you'll probably have to update this file. There are two lines you need to modify to suit your new 'stamp' variable.
the time format specification
'$SearchDate' is the variable used in the PERL script to do exactly what it says, search for the date stamp. I have it set up to look for the format 'year-month-date hour:minute:second'. Note, we don't care about brackets or anything here, we're just defining the format of the date/time stamp.
...
$SearchDate = TimeFilter('%Y-%m-%d %H:%M:%S');
...
If you changed the 'stamp' variable so it was formatted as 'month/day/year hour:minute' (ex: '[09/27/2018 18:38]') then you'd update the $SearchDate variable as follows (note: no mention of the square brackets!):
...
$SearchDate = TimeFilter('%m/%d/%Y %H:%M');
...
the search REGEX
The PERL script uses a 'regular expression' (REGEX) to search within the log file for '$SearchDate'. For the default datestamp, this specification looks like:
...
if ($ThisLine =~ m/\[$SearchDate\] /o) {
...
The REGEX appears between 'm/' and '/o'. In this case, it searches for '$SearchDate' inside [square brackets] appearing anywhere on the line. This is because ANSI colour-codes often appear before the datestamp in the default log file. If you have modified this so that your datestamp appears at the beginning of the line and in the example format in the section above (using slashes instead of dashes) then you'd rewrite this REGEX as follows:
...
if ($ThisLine =~ m/^\[$SearchDate\] /o) {
...
or using regular brackets anywhere on the line:
...
if ($ThisLine =~ m/\($SearchDate\) /o) {
...
or without any brackets but appearing at the beginning of the line:
...
if ($ThisLine =~ m/^$SearchDate /o) {
...