topic Re: Why is TIME_FORMAT not working in props.conf? in Getting Data In

Why is TIME_FORMAT not working in props.conf?

sheloaha — Tue, 07 Jun 2016 16:10:42 GMT

My events have the following timestamp at the beginning of each line:

[2016-05-18T18:41:51.440-04:00]

In props.conf, I set the following but it is not working:

NO_BINARY_CHECK=true
disabled=false
TIME_PREFIX=^[
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N
TZ=America/New_York

Any ideas on why this is not working?

woodcock — Wed, 08 Jun 2016 06:01:53 GMT

Change these:

TIME_PREFIX = ^\[
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%z

Also leave out the TZ line because the event has the timezone already (you just need to specify that it is there).

sheloaha — Wed, 15 Jun 2016 18:06:45 GMT

Thank you! That made the difference.