On Thu, 26 Jan 2012, Lars Peterson wrote:
A date field shall be of the form 1995-12-31T23:59:59Z The trailing "Z"
designates UTC time and is mandatory (See below for an explanation of UTC). Optional
fractional seconds are allowed, as long as they do not end in a trailing 0 (but any
precision beyond milliseconds will be ignored). All other parts are mandatory.
I sniffed the wire to see what rsyslog is sending to SOLR and I see that the
output (RFC-3339) is formatted like so:
2012-01-25T21:46:13.102571+00:00
When I attempt to insert the document using this format I get an error:
The request sent by the client was syntactically incorrect (ERROR: [doc=null]
Error adding field 'generated'='2012-01-25T21:46:13.102571+00:00').
I see 3 possible workarounds:
1) Add another property option to format the timestamp so that its
compliant with ISO-8601 / Java DateField
this is the right option to take.
currently you are doing %timegenerated:::date-rfc3339%
change it to %timegenerated:1:19:date-rfc3339%Z
this will grab the first 19 characters of the timestamp (up to seconds)
and then the Z will be added (as it's outside the %)
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
