I have events which start like
16OCT13 AAAB 12:59:00 JAJAS DKDJD KDD
16OCT13 AABB 13:00:00 AJAJA AKAJK AKA
But i am not able to extract that particular timestamp for events
In my props.conf i used:
SHOULD_LINEMERGE=false
TIME_PREFIX=^
TIME_FORMAT=%d%b%y [A-Z]{4} %H:%M:%S
But doesn't seem to work. Please tell me what i am doing wrong?
TIME_FORMAT
does not accept regexes, only strptime style format
In your case you'd need put the literal AABB
string in TIME_FORMAT=%d%b%y AABB %H:%M:%S
.
Else, if the string is not known in advance, you'd probably need a custom datetime.xml
TIME_FORMAT
does not accept regexes, only strptime style format
In your case you'd need put the literal AABB
string in TIME_FORMAT=%d%b%y AABB %H:%M:%S
.
Else, if the string is not known in advance, you'd probably need a custom datetime.xml
I used configuration like
<text><![CDATA[(?<![\d\.])([012]\d|3[01])(JAN|FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV|DEC)(20\d\d|19\d\d|[901]\d(?!\d))\s\w+\s([01]\d|2[0123])\:([0-6]\d)\:([0-6]\d)]]>\s*</text>
</define>
In data preview it seems to work..but when i configure to read data from files, no data is getting indexed
oh ok ...is there any documentation on making changes in datetime.xml