TIME_FORMAT vs DATETIME_CONFIG = CURRENT

[vbumgarner]

I have a log file that has a date at the top, but otherwise is essentially unpredictable stdout. It could be written to for minutes or days.

This seems appropriate and acceptable:
SHOULD_LINEMERGE = False
DATETIME_CONFIG = CURRENT

What I'm wondering is if I have a TIME_PREFIX and TIME_FORMAT, will it try those first? The first line is predictable, so I could at least capture that single real date.

[gacerioni]

Hello!

It will ignore all settings based on the text(raw) event. Also, it follows the same rule as if you put "NONE".

[hazekamp]

V,

I believe setting DATETIME_CONFIG=CURRENT or DATETIME_CONFIG=NONE will ignore TIME_PREFIX/TIME_FORMAT (you can only use one or the other; not one then the other).