Syslog's yearless stamp (Oct 1 00:00:02) is a built-in

[torstei]

Classic syslog stamps carry no year, so every line of such a file went unstamped and a file-intake set could not name them (DECLARE cannot hold a regex with spaces).

• Built-in syslog stamp, anchored at line start; no declaration needed, so one set serves classic-syslog and ISO hosts alike.
• The year is the latest one not after a reference: the source's mtime on the write path (re-read as a tail reads), the chunk's write-window end on the read path. Stateless, and a file spanning New Year resolves by itself.
• A declared timestamp_format that names no year gets the same rule.
• Known limit: a copied/touched file with a wrong mtime resolves to the wrong year.

Plan: docs/plans/yearless-stamps.md. Tests: unit tests for year resolution; checked end to end with an import and query across New Year.

🤖 Generated with Claude Code