Multiple timestamp fields in a log


Author
Message
dicetube
dicetube
New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)
Group: Forum Members
Posts: 6, Visits: 6
Hello, I have time stamps in my log file.  The first parses correctly and displays correctly.  The second and third are omitted.  They are set up in the parser wizard but only as "timestamp" and are dropped in the log view.  Is there a way to include them and/or also name these fields (start time/end time etc)
LogViewPlus Support
LogViewPlus Support
Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)
Group: Moderators
Posts: 1.1K, Visits: 3.6K
Hi - thanks for reaching out. 

LogViewPlus can parse files log files with multiple timestamp formats, but this needs to be configured manually.  See multi-patterns for more information.  The date specifier documentation might also help.

Alternatively, if you can send me a few sample log entries, I would be happy to help you create a parser configuration.

Hope that helps,

Toby
dicetube
dicetube
New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)
Group: Forum Members
Posts: 6, Visits: 6
Hello,
thanks, I will give that a try. I have also attached a sample log file though, sometimes it's good to see how you would do it to gain insight into the product.
Attachments
sample log.txt (110 views, 830 bytes)
dicetube
dicetube
New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)
Group: Forum Members
Posts: 6, Visits: 6
This is what I have for the parser for the attached file

%S{Sequence}    %d{yyyyMMddTHHmmss.fffzzz}    %p    %S{Hostname}    %S{Logger}    %S{Thread}    %S{Id}    %S{ServiceUser}    %S{Message}    %S{Exception}    %S{StackTrace}    %S{ProxySessionId}    %S{TaskId}    %S{TaskName}    %S{AppId}    %S{AppName}    %S{ExecutionId}    %S{ExecutingNodeId}    %S{ExecutingNodeName}    %S{Status}    %d{yyyyMMddTHHmmss.fffzzz}    %d{yyyyMMddTHHmmss.fffzzz}    %S{Duration}    %S{FailureReason}    %S{Id2}%n

Edited 9 Months Ago by LogViewPlus Support
LogViewPlus Support
LogViewPlus Support
Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)
Group: Moderators
Posts: 1.1K, Visits: 3.6K
I am getting a good parse of your sample log file with that configuration.



I did change your configuration to use \t instead of tabs.  This might make it a bit easer to read:

%S{Sequence}\t%d{yyyyMMddTHHmmss.fffzzz}\t%p\t%S{Hostname}\t%S{Logger}\t%S{Thread}\t%S{Id}\t%S{ServiceUser}\t%S{Message}\t%S{Exception}\t%S{StackTrace}\t%S{ProxySessionId}\t%S{TaskId}\t%S{TaskName}\t%S{AppId}\t%S{AppName}\t%S{ExecutionId}\t%S{ExecutingNodeId}\t%S{ExecutingNodeName}\t%S{Status}\t%d{yyyyMMddTHHmmss.fffzzz}\t%d{yyyyMMddTHHmmss.fffzzz}\t%S{Duration}\t%S{FailureReason}\t%S{Id2}%n



Hope that helps,

Toby


Edited 9 Months Ago by LogViewPlus Support
LogViewPlus Support
LogViewPlus Support
Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)
Group: Moderators
Posts: 1.1K, Visits: 3.6K
Ah - I think I see the issue you are having.  You have three date time columns.  This will not work as written.  

%d is used to indicate the log entry timestamp.  Using this field multiple times will simply be updating the existing timestamp.  If you have 3 date fields in a log entry, one is the timestamp and the other two are just data columns.

For example:
%d{yyyyMMddTHHmmss.fffzzz}\t%d{yyyyMMddTHHmmss.fffzzz}

Becomes:
%s{Date1}\t%s{Date2}

dicetube
dicetube
New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)New Member (8 reputation)
Group: Forum Members
Posts: 6, Visits: 6
Got it, so no way to format that as a human readable date.  It's easy enough to read though.  Just have to use eye parsers.

That worked as you indicated.  Thanks for the \t, that helped a lot as well! 
LogViewPlus Support
LogViewPlus Support
Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)Respected User (1.8K reputation)
Group: Moderators
Posts: 1.1K, Visits: 3.6K
Glad that helped!  

Unfortunately, there is no way to format the additional dates.  Currently, LVP will just treat them as strings for sorting and data analysis purposes.
GO

Merge Selected

Merge into selected topic...



Merge into merge target...



Merge into a specific topic ID...




Similar Topics

Login

Explore
Messages
Mentions
Search