1

I have a tab-delimited logs with such messages:

2014-06-01  00:00:56    192.168.1.1 968 http://yandex.ru

I can extract date and time with regexp (\d{4}-\d{2}-\d{2}\s*\d{2}:\d{2}:\d{2}) but when I try to convert it to timestamp with pattern yyyy-MM-dd hh:mm:ss it fails with error:

MapperParsingException[failed to parse [timestamp]]; nested: MapperParsingException[failed to parse date field [2014-06-01  00:00:56], tried both date format [yyyy-MM-dd HH:mm:ss.SSS], and timestamp number with locale []]; nested: IllegalArgumentException[Invalid format: "2014-06-01 00:00:56" is malformed at " 00:00:56"];

I suggest it happens because I have a space in the pattern between date and time parts instead a tab between them in the message. But I don't know, how to fix it.

Michael
  • 43
  • 1
  • 2
  • 5
  • Are there any advanced options when converting like convert only date or only time and can you convert them separately? Can you change the application to log in the format that it expects? – anzenketh Aug 06 '14 at 20:36
  • @anzenketh, I can convert it separately, I assume. But then I need to combine it to a single timestamp field, right? And I don't know in what way it can be doing. I can change application output format and it is a last option, will be used, if there is no way to process tab-separated log correctly. – Michael Aug 07 '14 at 02:22
  • 1
    For a now I use this workaround: `cat tabbed.log | tr "\t" "#" > pounded.log` - replacing tabs with other delimiter. And then `yyyy-MM-dd#HH:mm:ss` works perfectly. I'll be glad to see true solution for tab-delimited files, nonetheless. – Michael Aug 07 '14 at 16:32

0 Answers0