rgerhards at hq
Jan 25, 2012, 10:21 PM
Post #4 of 4
(204 views)
Permalink
|
%TIMESTAMP:1:24:date-rfc3339%,
> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Xuan Zhong
> Sent: Thursday, January 26, 2012 3:38 AM
> To: rsyslog [at] lists
> Subject: Re: [rsyslog] Timestamp formatting
>
>
> Hi,
>
> I subscribed to the mailer list but didn't receive the email. I saw
> other people responded my previous email in the http archives link.
> I tried to extract the date part using the start and end position of
> the string, it didn't work.
> Here is my timestamp template: %TIMESTAMP:::date-rfc3339%
> I tried to extract the substring position from 1 to 24,
> %TIMESTAMP:::date-rfc3339:1:24%, which gave me a totally different
> formatted timestamp.
> Any idea which part is wrong? I tried to use that to extract part of
> msg text, it did work, like %msg:1:24% gave me first 24 characters.
>
> Thanks
> Xuan
>
>
> Search for the property replacer, you can set the start and endposition
> oft
> he string. Yoou need to extract the date, then put a SP into the
> template,
> than extract the time part
>
> rg
>
> From: xuan_zhong [at] hotmail
> To: rsyslog [at] lists
> Subject: Timestamp formatting
> Date: Tue, 24 Jan 2012 20:39:37 +0000
>
>
>
>
>
>
>
>
> Hi,
> I am using rfc3339 to format the timestamp and get the following in the
> log:
> 2012-01-24T21:36:11.860808+01:00
>
> Does anyone know if there is a way to change the template to display
> only part of the Timestamp: 2012-01-24T21:36:11.8608 which is fixed
> length string and replace T with a white space?
>
> Thanks
> Xuan
>
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
|
