Grok "TIME" failing on unpadded "seconds"
Description
Gliffy Diagrams
Activity
Show:
Philippe Weber February 18, 2014 at 2:14 PM
Nabeel S. November 16, 2012 at 6:38 PM
Seems like this fixed it, in grok_pattern
Adding a ? after the [0-5]. I can fork it and do a pull request, if you'd like
Nabeel S. November 16, 2012 at 6:33 PMEdited
Sorry, yes, I meant the day. Trying with one 's', didn't help either:
And the other issue is that it's not setting the fields in gelf, but this parsing both padded/unpadded comes first
Jordan Sissel November 16, 2012 at 6:14 PM
Try
timestamp => "yyyy-mm-dd'T'HH:mm:s.SSSSSS"
(one 's' not two) to see if that helps your situation. I believe 'ss' requires that it be a two-digit second value. The 'dd' matching '5' as a day may just be a bug in the time parser.
Jordan Sissel November 16, 2012 at 6:11 PM
you mean the day? ('5' in 2012-10-5) right?
Fixed
Details
Details
Assignee
Philippe WeberReporter
Nabeel S.Labels
Fix versions
Created November 16, 2012 at 6:01 PM
Updated February 18, 2014 at 2:14 PM
Resolved February 18, 2014 at 2:14 PM
Not sure if I am doing something wrong here, but this fails if the seconds are not padded:
Pattern:
Filter:
Fails:
Works (only the seconds are padded)