Configuration of extractor:
{ "extractors": [ { "title": "TIMESTAMP", "extractor_type": "regex", "converters": [ { "type": "date", "config": { "date_format": "yyyy-MM-dd HH:mm:ss.SSS", "time_zone": "" } } ], "order": 0, "cursor_strategy": "copy", "source_field": "message", "target_field": "TIMESTAMP", "extractor_config": { "regex_value": "(\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2},\\d{3}|\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}.\\d{3})" }, "condition_type": "none", "condition_value": "" } ], "version": "3.1.3" }
TT2 test log data:
2019-12-03 07:37:28.809 INFO [main >> BackOfficeEndOfMarketTest] util.Rest - PUT request finished for 110 ms; response status: 200
NODE log data:
2019-12-03T07:31:28,172 INFO c.s.c.p.s.q.NGQuartzScheduler [main] NGQuartzScheduler singleton instance is created.
My idea was to create field TIMESTAMP(the real one from the logs) so I am using extractor but the timestamps are different between logs so the next step is obviously to convert all of them to one format.
And here starts the headache, This rule from above is adding letter Z at the end of the TT2 timestamp(example: " 2019-12-03T07:37:28.692Z ") and when I want to sort the lines via timestamp, of course, I am getting en error, because the format is not the same.
What could be the problem?