topic CSV timestamp based on 2 columns in Getting Data In

CSV timestamp based on 2 columns

aasabatini — Thu, 17 Jun 2021 16:36:14 GMT

Hi folks,

I need an help, I have to index a csv file, currently this csv file have a column for a date and another one for the hous, I need to merge these to columns to extract the timestamp aat index time with a props file.

Example

Field 1	date	hour
abc	16-06-2021	16:00 17:00
abc	16-06-2021	16:00 17:00
abc	etc....	etc...
abc	etc...	etc...

on the hour column I need only the first value

thanks in advance

Ale

Re: CSV timestamp based on 2 columns

richgalloway — Thu, 17 Jun 2021 18:15:33 GMT

props.conf has settings for that.

[mysourcetype] INDEXED_EXTRACTIONS = CSV TIMESTAMP_FIELDS = date,hour TIME_FORMAT = %d-%m-%Y,%H:%M

I'm not 100% certain about the separator to use in TIME_FORMAT so the comma may have to change.

Re: CSV timestamp based on 2 columns

aasabatini — Fri, 18 Jun 2021 12:21:03 GMT

Thanks @richgalloway

works fine!

Ale