Hello community,


An actual raw log example is:
<142>Jan 30 15:27:47 mx2 bmserver: 1580383667|50538744-5afff7000000136c-c7-5e32bdb3d3ce|VERDICT|<none>|connection_class_1|default|static connection class 1

I need correct Date Format to parse Log Source Time



------------------------------
Davit Ubilava
System Administrator
Delta Consulting LLC
Tbilisi,Georgia
------------------------------

Hi,

I am facing the same issue. Wating for the replies.

------------------------------
Halil BALIM
------------------------------

I think Jonathan addressed something like this in the forums :
https://developer.ibm.com/answers/questions/385125/format-for-overriding-log-source-time-in-dsm-edito/

------------------------------
Dusan VIDOVIC
------------------------------

Hi,

I think you must use $1 with format string.


------------------------------
Ali Rıza Yüksektepe
------------------------------

Hi Davit,

The date format string hat a hyphen ("-") between "MMM" and "dd" whereas the actual log message does not. Could that be the reason for the regex matching the timestamp but the log source time not being parsed?

Cheers,

   Andreas

------------------------------
Andreas Leibl
------------------------------

Ali and Andreas each have half the answer. The Format String field uses $x notation to refer to capture groups in the Regex field, so you need to use $1, not 1 as your Format String. Just using "1" would set the value to a literal "1".

The Date Format also needs to be adjusted, it should be:

MMM dd HH:mm:ss

no dash/hyphen between "MMM" and "dd".

Cheers
Colin

------------------------------
COLIN HAY
------------------------------