Hi Folks,
could you please anyone help me to write the TIME_FORMAT , TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD for below log type.
logs:
[10/05/17 03:47:03.447]:AP-AD ST: Rule rejected.
[10/05/17 03:47:03.447]:AP-AD ST:Policy returned:
[10/05/17 03:47:03.447]:AP-AD ST:Applying policy: %+C%14Cmon-otp-ConvertVoiceMailClass%-C.
[10/05/17 03:47:03.447]:AP-AD ST: Applying to query #1.
my configuration
[ autolearned__ ]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)([\d{2}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2}.\d{3}]:\w+-\w+\s\w+:)
TRUNCATE =999999
KV_MODE=None
TIME_FORMAT=
TIME_PREFIX=
MAX_TIMESTAMP_LOOKAHEAD=
Try these settings.
TIME_PREFIX = \[
TIME_FORMAT = %m/%d/%y %H:%M:%S.%3N
Try these settings.
TIME_PREFIX = \[
TIME_FORMAT = %m/%d/%y %H:%M:%S.%3N
Thanks Richagalloway,
The above setting is working as i expected. i would like to know the value of MAX_TIMESTAMP_LOOKAHEAD. could you please the value for MAX_TIMESTAMP_LOOKAHEAD so will complete that configuration.
In this case MAX_TIMESTAMP_LOOKAHEAD = 21
is good.