1

I have a tab-delimited logs with such messages:

2014-06-01  00:00:56    192.168.1.1 968 http://yandex.ru

I can extract date and time with regexp (\d{4}-\d{2}-\d{2}\s*\d{2}:\d{2}:\d{2}) but when I try to convert it to timestamp with pattern yyyy-MM-dd hh:mm:ss it fails with error:

MapperParsingException[failed to parse [timestamp]]; nested: MapperParsingException[failed to parse date field [2014-06-01  00:00:56], tried both date format [yyyy-MM-dd HH:mm:ss.SSS], and timestamp number with locale []]; nested: IllegalArgumentException[Invalid format: "2014-06-01 00:00:56" is malformed at " 00:00:56"];

I suggest it happens because I have a space in the pattern between date and time parts instead a tab between them in the message. But I don't know, how to fix it.

Improve this question
3
  • Are there any advanced options when converting like convert only date or only time and can you convert them separately? Can you change the application to log in the format that it expects?
    – anzenketh
    Aug 6, 2014 at 20:36
  • @anzenketh, I can convert it separately, I assume. But then I need to combine it to a single timestamp field, right? And I don't know in what way it can be doing. I can change application output format and it is a last option, will be used, if there is no way to process tab-separated log correctly.
    – Michael
    Aug 7, 2014 at 2:22
  • 1
    For a now I use this workaround: cat tabbed.log | tr "\t" "#" > pounded.log - replacing tabs with other delimiter. And then yyyy-MM-dd#HH:mm:ss works perfectly. I'll be glad to see true solution for tab-delimited files, nonetheless.
    – Michael
    Aug 7, 2014 at 16:32

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .