LogViewPlus Support

Multiple timestamp fields in a log

https://www.logviewplus.com/forum/Topic1757.aspx

By dicetube - 11 May 2023

Hello, I have time stamps in my log file.  The first parses correctly and displays correctly.  The second and third are omitted.  They are set up in the parser wizard but only as "timestamp" and are dropped in the log view.  Is there a way to include them and/or also name these fields (start time/end time etc)
By LogViewPlus Support - 11 May 2023

Hi - thanks for reaching out. 

LogViewPlus can parse files log files with multiple timestamp formats, but this needs to be configured manually.  See multi-patterns for more information.  The date specifier documentation might also help.

Alternatively, if you can send me a few sample log entries, I would be happy to help you create a parser configuration.

Hope that helps,

Toby
By dicetube - 11 May 2023

Hello,
thanks, I will give that a try. I have also attached a sample log file though, sometimes it's good to see how you would do it to gain insight into the product.
By dicetube - 11 May 2023

This is what I have for the parser for the attached file

%S{Sequence}    %d{yyyyMMddTHHmmss.fffzzz}    %p    %S{Hostname}    %S{Logger}    %S{Thread}    %S{Id}    %S{ServiceUser}    %S{Message}    %S{Exception}    %S{StackTrace}    %S{ProxySessionId}    %S{TaskId}    %S{TaskName}    %S{AppId}    %S{AppName}    %S{ExecutionId}    %S{ExecutingNodeId}    %S{ExecutingNodeName}    %S{Status}    %d{yyyyMMddTHHmmss.fffzzz}    %d{yyyyMMddTHHmmss.fffzzz}    %S{Duration}    %S{FailureReason}    %S{Id2}%n
By LogViewPlus Support - 11 May 2023

I am getting a good parse of your sample log file with that configuration.



I did change your configuration to use \t instead of tabs.  This might make it a bit easer to read:

%S{Sequence}\t%d{yyyyMMddTHHmmss.fffzzz}\t%p\t%S{Hostname}\t%S{Logger}\t%S{Thread}\t%S{Id}\t%S{ServiceUser}\t%S{Message}\t%S{Exception}\t%S{StackTrace}\t%S{ProxySessionId}\t%S{TaskId}\t%S{TaskName}\t%S{AppId}\t%S{AppName}\t%S{ExecutionId}\t%S{ExecutingNodeId}\t%S{ExecutingNodeName}\t%S{Status}\t%d{yyyyMMddTHHmmss.fffzzz}\t%d{yyyyMMddTHHmmss.fffzzz}\t%S{Duration}\t%S{FailureReason}\t%S{Id2}%n



Hope that helps,

Toby
By LogViewPlus Support - 11 May 2023

Ah - I think I see the issue you are having.  You have three date time columns.  This will not work as written.  

%d is used to indicate the log entry timestamp.  Using this field multiple times will simply be updating the existing timestamp.  If you have 3 date fields in a log entry, one is the timestamp and the other two are just data columns.

For example:
%d{yyyyMMddTHHmmss.fffzzz}\t%d{yyyyMMddTHHmmss.fffzzz}

Becomes:
%s{Date1}\t%s{Date2}
By dicetube - 11 May 2023

Got it, so no way to format that as a human readable date.  It's easy enough to read though.  Just have to use eye parsers.

That worked as you indicated.  Thanks for the \t, that helped a lot as well! 
By LogViewPlus Support - 11 May 2023

Glad that helped!  

Unfortunately, there is no way to format the additional dates.  Currently, LVP will just treat them as strings for sorting and data analysis purposes.