We are getting events from one of our application ,But the indexed time and event logged time is different ,Please let me know how to fix this timestamp issues and not getting milliseconds in time.
Event list below:
Time Event
2/27/19 { [-]
6:24:31.000 PM @timestamp: 2019-02-27T18:19:59.757Z
Props.conf
[XXXXXX]
SHOULD_LINEMERGE=true
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
TIME_PREFIX=@timestamp":
TRUNCATE = 0
Here are what seem to be the settings you're looking for:
SHOULD_LINEMERGE=true
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
TIME_PREFIX=(@timestamp)
TIME_FORMAT=%Y-%m-%dT%H:%M:%D.%3Q
MAX_TIMESTAMP_LOOKAHEAD=30
Let me know please
Here are what seem to be the settings you're looking for:
SHOULD_LINEMERGE=true
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
TIME_PREFIX=(@timestamp)
TIME_FORMAT=%Y-%m-%dT%H:%M:%D.%3Q
MAX_TIMESTAMP_LOOKAHEAD=30
Let me know please