Could you please anyone help me to write the time_format for bellow logs.

[lksridhar]

Hi Folks,

could you please anyone help me to write the TIME_FORMAT , TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD for below log type.

logs:

[10/05/17 03:47:03.447]:AP-AD ST: Rule rejected.
[10/05/17 03:47:03.447]:AP-AD ST:Policy returned:
[10/05/17 03:47:03.447]:AP-AD ST:Applying policy: %+C%14Cmon-otp-ConvertVoiceMailClass%-C.
[10/05/17 03:47:03.447]:AP-AD ST: Applying to query #1.

my configuration

[ autolearned__ ]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)([\d{2}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2}.\d{3}]:\w+-\w+\s\w+:)
TRUNCATE =999999
KV_MODE=None
TIME_FORMAT=
TIME_PREFIX=
MAX_TIMESTAMP_LOOKAHEAD=

[richgalloway · Accepted solution]

Try these settings.

TIME_PREFIX = \[
TIME_FORMAT = %m/%d/%y %H:%M:%S.%3N

[lksridhar]

Thanks Richagalloway,

The above setting is working as i expected. i would like to know the value of MAX_TIMESTAMP_LOOKAHEAD. could you please the value for MAX_TIMESTAMP_LOOKAHEAD so will complete that configuration.

[richgalloway]

In this case MAX_TIMESTAMP_LOOKAHEAD = 21 is good.