Getting Data In

Why is TIME_FORMAT not working in props.conf?

Path Finder

My events have the following timestamp at the beginning of each line:

[2016-05-18T18:41:51.440-04:00] 

In props.conf, I set the following but it is not working:

NO_BINARY_CHECK=true
disabled=false
TIME_PREFIX=^[
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N
TZ=America/New_York

Any ideas on why this is not working?

Tags (2)
0 Karma
1 Solution

Esteemed Legend

Change these:

TIME_PREFIX = ^\[
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%z

Also leave out the TZ line because the event has the timezone already (you just need to specify that it is there).

View solution in original post

0 Karma

Esteemed Legend

Change these:

TIME_PREFIX = ^\[
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%z

Also leave out the TZ line because the event has the timezone already (you just need to specify that it is there).

View solution in original post

0 Karma

Path Finder

Thank you! That made the difference.

0 Karma