Please help me with props.conf file i have sample data below i want to extract time stamp from the below sample data.
BREAK_ONLY_BEFORE=
TIME_PREFIX=
TIME_FORMAT=
10.123.123.12 - - [02/Nov/2016:00:36:31 -0500] "POST /comp/apps/services/api/comp/iphone/init HTTP/1.1" 123 12345 1234 WAS=abc-abcdef12-xzy12.maps.ib:1234 TMS=12345 T=0 "-" "comp/7.0.26 (iPhone; iOS 10.0.1; Scale/2.00),comp/7.0.26 (iPhone; iOS 10.0.1; Scale/2.00)/somexzyAPI/7.0.0.0" "-" JSessionID=1234aLpYQEcNOxbnZeE7eCMv5zO:mfp-wlprod12-abc01-MfpProdSrv12 "-"
Try this for your sourcetype definition/props.conf
[yoursourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER = ([\r\n]+)(?=\d+\.\d+\.\d+\.\d+\s+)
TIME_PREFIX = ^(\S+\s+){3}\[
TIME_FORMAT = %d/%b/%Y:%H:%M:%S %z
MAX_TIMESTAMP_LOOKAHEAD = 26
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
TIME_FORMAT=%d/%b/%Y:%H:%M:%S %z
TIME_PREFIX=\[
MAX_TIMESTAMP_LOOKAHEAD=26
CHARSET=UTF-8
thanks sir this is also working.
Try this for your sourcetype definition/props.conf
[yoursourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER = ([\r\n]+)(?=\d+\.\d+\.\d+\.\d+\s+)
TIME_PREFIX = ^(\S+\s+){3}\[
TIME_FORMAT = %d/%b/%Y:%H:%M:%S %z
MAX_TIMESTAMP_LOOKAHEAD = 26
I had the same question just last week. Somesoni2's answer worked for me 🙂
thanks its working
Try this
[YOUR_SOURCETYPE]
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S,$3N