DateTime Extractor extracting "Timezone String" failing

Graylog Central (peer support)
1

Hi there, i am trying to extract the timestamp from the following message. I also like to extract the time zone as well because that can change in the mesages (from Europe/Berlin to UTC for example).

“[24-Jan-2019 15:06:17 Europe/Berlin] PHP Warning: file_exists(): open_basedir restriction in effect. File(”

I am using the Date converter and the following format string:
“dd-MMM-yyyy HH:mm:ss z” - already tried it with a capital Z as well.
The extractor is always failing with the message “java.lang.IllegalArgumentException: Invalid format: “24-Jan-2019 15:11:59 Europe/Berlin” is malformed at “Europe/Berlin”” which i don’t understand.

In the documentation it’s clearly stated that “Z” should match the Timezone string.
As well i tried to parse the date online using https://java-time-parse-debugger.herokuapp.com/. Thats working fine with the same string.

In the extractor UI i left timezone and locale blank.

2

I found out what was wrong:

The correct format string should be: “dd-MMM-yyyy HH:mm:ss ZZZ”
You need three times the “Z” to parse Strings like “Europe/Berlin”. Maybe the documentation should be updated from the jodaTime one!

1 Like
3

I’d suggest putting an issue in on the graylog github :slight_smile:

4

Okay i just created an issue:

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.