David, Love those 4 character fixes. Works perfectly now. Thank you so much!!!
-Lars -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of [email protected] Sent: Thursday, January 26, 2012 11:03 AM To: rsyslog-users Cc: [email protected] Subject: Re: [rsyslog] Date formatting property options incompatible with SOLR DateField On Thu, 26 Jan 2012, Lars Peterson wrote: > A date field shall be of the form 1995-12-31T23:59:59Z The trailing "Z" > designates UTC time and is mandatory (See below for an explanation of UTC). > Optional fractional seconds are allowed, as long as they do not end in a > trailing 0 (but any precision beyond milliseconds will be ignored). All other > parts are mandatory. > > I sniffed the wire to see what rsyslog is sending to SOLR and I see that the > output (RFC-3339) is formatted like so: > > 2012-01-25T21:46:13.102571+00:00 > > When I attempt to insert the document using this format I get an error: > > The request sent by the client was syntactically incorrect (ERROR: [doc=null] > Error adding field 'generated'='2012-01-25T21:46:13.102571+00:00'). > > I see 3 possible workarounds: > > > 1) Add another property option to format the timestamp so that its > compliant with ISO-8601 / Java DateField this is the right option to take. currently you are doing %timegenerated:::date-rfc3339% change it to %timegenerated:1:19:date-rfc3339%Z this will grab the first 19 characters of the timestamp (up to seconds) and then the Z will be added (as it's outside the %) David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/
