AnsweredAssumed Answered

Custom Time stamp to event.time meta

Question asked by Erika Szabo on Mar 22, 2018

Dear Parser Gurus!

I have a question about using EVNTTIME function in a custom parser.
I have date format on the log like: 2018-03-21 09:30:10,004
I was able to convert it with <@event_time:*EVNTTIME($HDR,'%W-%M-%D %H:%T:%S',hdate,htime)>, but I miss the milliseconds.

Other timestamp is: 2018-02-23T09:56:14.616848Z where I also could not handle the part after the point.
<@event_time:*EVNTTIME($MSG,'%W-%M-%D %H:%T:%S',date,time)>

Can You give me a better solution?
Thank You in advance, Erika

esi esi tool parsing log parser

Outcomes