Time capturing regex for virtual index that points to AWS ELB logs in s3 bucket does not work

[tkashem]

I am using a virtual index that points to AWS ELB logs in S3 bucket to run Splunk query. I have set this up using Hunk app in Splunk which uses an EMR cluster in Amazon to run the queries.

It seems Time capturing regex defined in virtual index never works. I see plenty of the following error in server logs.

04-30-2015 04:09:49.282 WARN  ERP.elb_log_provider -  VixTimeSpecifier - Could not match time regex="/AWSLogs/*/elasticloadbalancing/*/(\d+)/(\d+)/(\d+)/*" against path="/AWSLogs//elasticloadbalancing/us-east-1/2015/04/18/_elasticloadbalancing_us-east-1__20150418T0055Z_.log"

Can anyone help me find out what's going on here?
Thanks in advance!

[rdagan_splunk]

What is the indexes.conf file looks like (hunk/etc/apps/search/local/indexes.conf)?

[rdagan_splunk]

It looks like the regex requires a . before the Star (.*)
And vix.input.1.lt.offset = 86400

[tkashem]

Sorry for the delay - here is relevant parts of indexes.conf file -

vix.description = prod-elb
vix.input.1.accept = \.log$
vix.input.1.path = s3://foo/AWSLogs/...
vix.provider = development-cluster
vix.input.1.et.format = yyyyMMdd
vix.input.1.et.offset = 0
vix.input.1.et.regex = /foo/AWSLogs/*/elasticloadbalancing/*/(\d+)/(\d+)/(\d+)/
vix.input.1.lt.format = yyyyMMdd
vix.input.1.lt.regex = /foo/AWSLogs/*/elasticloadbalancing/*/(\d+)/(\d+)/(\d+)/
vix.input.1.lt.offset = 0