timestamp parsing issue for a specific time

[kteng2024]

my log is:

2016-12-22 00:01:11,076 [myid:123] - INFO [xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx] - Accepted data from

in the props:

TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 30
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N

but i am still getting this error " failed to parse the timestamp" . after increasing the lookahead value , this error was disappeared for some time and it started to come back again. can anyone please help me to figure out what might be the issue .

[woodcock]

You are going to have to find the events that are different that what you are expecting. Start by searching broadly and using the Patterns tab and the punct field to discern differences in log structure.

[woodcock]

The length of the timestamp is 23 characters, not 30, so you need:

MAX_TIMESTAMP_LOOKAHEAD = 23

[kteng2024]

i added the buffer of 7 .

[woodcock]

Don't do that.

[somesoni2]

MAX_TIMESTAMP_LOOKAHEAD value should be 23, length of timestamp.