Hello,

We are working with docker and we aggregate our logs from various sources into a single log stream. Sometimes the log messages arrive out of order and we need to sort them. We have a problem sorting the logs from docker that are formatted using the RFC5424 format in the syslog driver. When logs look like this:

2018-11-23T21:02:39.57518Z
2018-11-23T21:02:39.575182Z
2018-11-23T21:02:39.575183Z

they sort like this:

2018-11-23T21:02:39.575182Z
2018-11-23T21:02:39.575183Z
2018-11-23T21:02:39.57518Z

This is because the format truncates trailing zeroes, and Z comes after all numbers in sort order.

This can be solved by changing the RFC5424 golang format from 2006-01-02T15:04:05.999999Z07:00 to 2006-01-02T15:04:05.000000Z07:00. There is no text in the RFC that dictates that trailing zeros be truncated or not truncated.

I am thinking a change can be made that introduces a new format for rsyslog rfc5424micro-fw for "fixed width". If anyone else thinks this is a good idea I can make a pull request. If there's a better way that doesn't involve making a new format option, I'm open to suggestions.

Thanks!