For rule 'parse event timestamp': In call to function 'parse_date' at 5:19 an exception was thrown: Invalid format: ""


(pradeep) #1

I want to pipeline my log timestamp with graylog but i got Invalid format error
grok my timestamp into Timestamp_tweet
sample:- Fri Dec 21 19:09:36 +0000 2018
rule “parse event timestamp”
when
true
then
let new_date = parse_date(to_string($message.Timestamp_tweet), “EEE MMM dd HH:mm:ss Z yyyy”);
set_field(“timestamp”, new_date);
end

how can i solve this issue ?


(Jan Doberstein) #2

First you would get faster help if you format your postings in a way that somebody that is not you can unterstand what you write easily.

Your Sample timestamp is: Fri Dec 21 19:09:36 +0000 2018 and you try to match that with the following settings: EEE MMM dd HH:mm:ss Z yyyy. For me I got this parsing with the following working:
E MMM dd HH:mm:ss Z Y.

But I guess (because of your bad formatting) that the date is not the only content of your sample timestamp and you need to parse place that into a single field before you use the parse_date function.


(pradeep) #3

I am changed my pipeline format as E MMM dd HH:mm:ss Z Y but no luck
rule “parse event timestamp”
when
true
then
let new_date = parse_date(to_string($message.Timestamp_tweet), “E MMM dd HH:mm:ss Z Y);”);
set_field(“timestamp”, new_date);
end
log sample
“Mon Jan 07 17:30:00 +0000 2019 @Very excited that Apple is bringing AirPlay and iTunes to my Vizio TV (and apparently Samsung TVs too). An important https://t.co/4kbvJRfGwb

i have only grokked the timestamp(Mon Jan 07 17:30:00 +0000 2019) into Timestamp_tweet

Is anything wrong with my grok?


(Jan Doberstein) #4

the question is - does the grok date extractor run as extractor or processing pipeline? Does it run before or after your rule?

because the rule above can only work if the field “Timestamp_tweet” is given in the message.


(pradeep) #5

run as processing pipeline

Does it run before or after your rule? I didn’t get that ?

1)created grok for timestamp
2)add new pipeline
3)created rule for pipeline

i am done this steps and i got Invalid format error


(Jan Doberstein) #6

can you please be a little more specific about created grok for timestamp - what does that mean exactly for you? where did you created that and how should that run on incoming messages?


(pradeep) #7

“Mon Jan 07 17:30:00 +0000 2019 @Very excited that Apple is bringing AirPlay and iTunes to my Vizio TV (and apparently Samsung TVs too). An important https://t.co/4kbvJRfGwb”

  • I want to change graylog timestamp to this log timestamp
  • i am using input as gelf tcp in graylog and log comes from fluentd
  • created grok for timestamp:- through system --> grok, I stored log timesamp value (Mon Jan 07 17:30:00 +0000 2019) in Timestamp_tweet
  • Then i created new pipeline and rule
  • i am following this url to fix my issue:- Searching imported logs by log timestamp, not time Graylog received the log
  • rule:- rule “parse event timestamp”
    when
    true
    then
    let new_date = parse_date(to_string($message.Timestamp_tweet), “E MMM dd HH:mm:ss Z Y);”);
    set_field(“timestamp”, new_date);
    end
  • i dont know how its comes with incoming messages ,after creating pipeline and its rule, i got a field called gl2_processing_error

(Jan Doberstein) #8

so you actually do not use any processing pipeline or extractor to make the field “Timestamp_tweet” available? The parse_date function will need the date to be the only value in the field as it will not try to match something that looks like the given date.


(pradeep) #9

NO,how can i do it with processing pipeline? i am only grok the timestamp and stored in Timestamp_tweet and i created pipeline rule with this Timestamp_tweet
“rule “parse event timestamp”
when
true
then
let new_date = parse_date(to_string($message.Timestamp_tweet), “E MMM dd HH:mm:ss Z Y);”);
set_field(“timestamp”, new_date);
end”


(system) closed #10

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.