Hello,
I'm trying to extract timestamp from a message like this one :
*172.xx.xx.xx - - [18/Jun/2014:17:23:09 +0200] "GET /favicon.ico HTTP/1.1"
404 292 292*
but the extract fails and I have the following message in the Indexer
Failure logs
*MapperParsingException[failed to parse [timestamp]]; nested:
MapperParsingException[failed to parse date field [18/Jun/2014:17:42:34
+0200], tried both date format [yyyy-MM-dd HH:mm:ss.SSS], and timestamp
number with locale []]; nested: IllegalArgumentException[Invalid format:
"18/Jun/2014:17:42:34 +0200" is malformed at "/Jun/2014:17:42:34 +0200"]; *
My extractor configuration is the following :
*{ "extractors": [ { "condition_type": "none",
"condition_value": "", "converters": [ { "config":
{ "date_format": "dd/MMM/YYYY:HH:mm:ss Z" },
"type": "date" } ], "cursor_strategy": "copy",
"extractor_config": { "regex_value": ".+?\\[(.+?)\\]" },
"extractor_type": "regex", "order": 0, "source_field":
"message", "target_field": "timestamp", "title": "Overwrite
timestamp" } ], "version": "0.20.2"}*
Do you have any idea of what could cause this error ?
Thanks
--
You received this message because you are subscribed to the Google Groups
"graylog2" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
