Handling comma when converting extracted data to date type

(Dragan Bošnjak) #1


I am trying to convert data type of timestamp extracted with grok pattern, as described in documentation:

%{DATA:timestamp;date;dd/MMM/yyyy:HH:mm:ss Z}

Formatted time looks like this: 2018-04-19 13:01:24,450
I am using TIMESTAMP_ISO8601 to extract this data, and if i do this, it does work:

%{TIMESTAMP_ISO8601:timestamp;date;yyyy-MM-dd HH:mm:ss}

But i’m losing miliseconds. If i add miliseconds, like so:

%{TIMESTAMP_ISO8601:timestamp;date;yyyy-MM-dd HH:mm:ss,SSS}

…i get this error:

We were not able to run the grok extraction. Please check your parameters.
Details: Error: cannot POST http://hostname:9000/api/tools/grok_tester (500)

Error response looks like this:

{"type":"ApiError","message":"Illegal repetition near index ...           

It seems , character inside SimpleDateFormat expression yyyy-MM-dd HH:mm:ss,SSS is the issue. Are there any workarounds? I tried escaping it with \ but it didn’t help.

(Jochen) #2

Which version of Graylog are you using?

A similar date pattern is being used as test case in Graylog:

(Dragan Bošnjak) #3

Version is 2.4.3+2c41897.
Thanks for reply, pattern in that use case would work fine if my time format was different. I can use dot in the expression, but comma fails.

(Jochen) #4

It looks like this is a bug in the Grok library which is being used by Graylog:

(M D) #5

Try to debug your GROK Pattern using different inputs
[https://grokdebug.herokuapp.com/](http://Grok Debugger)

(system) closed #6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.