topic Re: Timestamp Parsing in JSON failed in Getting Data In

Timestamp Parsing in JSON failed

sunallen — Tue, 08 Jun 2021 15:04:15 GMT

Can anyone help me with best configurations for timestamp parsing (where "time" is the actual time) for following JSON format :

{"status":0,"description":"OK","data":{"railway_bloodPressure":[{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":67.0,"time":"2021-03-09 15:59:00","endTime":"2021-03-09 15:59:00","sys":124.0,"deviceId":"testing","dia":80.0},{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":71.0,"time":"2021-03-09 16:09:00","endTime":"2021-03-09 16:10:00","sys":-1.0,"deviceId":"testing","dia":-1.0},{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":69.0,"time":"2021-03-09 16:15:00","endTime":"2021-03-09 16:15:00","sys":127.0,"deviceId":"testing","dia":79.0},{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":66.0,"time":"2021-03-09 16:25:00","endTime":"2021-03-09 16:26:00","sys":-1.0,"deviceId":"testing","dia":-1.0},{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":67.0,"time":"2021-03-09 16:35:00","endTime":"2021-03-09 16:35:00","sys":125.0,"deviceId":"testing","dia":81.0},{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":68.0,"time":"2021-03-09 16:45:00","endTime":"2021-03-09 16:46:00","sys":-1.0,"deviceId":"testing","dia":-1.0},{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":68.0,"time":"2021-03-09 16:51:00","endTime":"2021-03-09 16:51:00","sys":127.0,"deviceId":"testing","dia":79.0}]}}

I have alrady tried in props.conf...but keep failing...

Re: Timestamp Parsing in JSON failed

richgalloway — Tue, 08 Jun 2021 15:59:23 GMT

Please share your props.conf settings for that sourcetype.

Re: Timestamp Parsing in JSON failed

sunallen — Wed, 09 Jun 2021 01:28:58 GMT

My props.conf

DATETIME_CONFIG = LINE_BREAKER = (.){"ptt NO_BINARY_CHECK = true TRUNCATE = 0 category = Custom disabled = false pulldown_type = 1 MAX_TIMESTAMP_LOOKAHEAD = 61 TIME_FORMAT = %Y-%m-%dT%T TIME_PREFIX = \"time\":"(.*?)" INDEXED_EXTRACTIONS = json

Re: Timestamp Parsing in JSON failed

richgalloway — Wed, 09 Jun 2021 14:41:16 GMT

The TIME_PREFIX and TIME_FORMAT settings are incorrect. Try these.

LINE_BREAKER = (.){"ptt NO_BINARY_CHECK = true TRUNCATE = 0 disabled = false MAX_TIMESTAMP_LOOKAHEAD = 21 TIME_FORMAT = %Y-%m-%d %H:%M:%S TIME_PREFIX = "time":" INDEXED_EXTRACTIONS = json

Re: Timestamp Parsing in JSON failed

sunallen — Thu, 10 Jun 2021 01:16:12 GMT

Thank you.