Mailing List Archive: RSyslog: users

Re: Date formatting property options incompatible with SOLR DateField

Index | Next | Previous | View Threaded

david at lang

Jan 26, 2012, 9:02 AM

Post #1 of 2 (126 views)
Permalink

Re: Date formatting property options incompatible with SOLR DateField

On Thu, 26 Jan 2012, Lars Peterson wrote:

> A date field shall be of the form 1995-12-31T23:59:59Z The trailing "Z" designates UTC time and is mandatory (See below for an explanation of UTC). Optional fractional seconds are allowed, as long as they do not end in a trailing 0 (but any precision beyond milliseconds will be ignored). All other parts are mandatory.
>
> I sniffed the wire to see what rsyslog is sending to SOLR and I see that the output (RFC-3339) is formatted like so:
>
> 2012-01-25T21:46:13.102571+00:00
>
> When I attempt to insert the document using this format I get an error:
>
> The request sent by the client was syntactically incorrect (ERROR: [doc=null] Error adding field 'generated'='2012-01-25T21:46:13.102571+00:00').
>
> I see 3 possible workarounds:
>
>
> 1) Add another property option to format the timestamp so that its compliant with ISO-8601 / Java DateField

this is the right option to take.

currently you are doing %timegenerated:::date-rfc3339%

change it to %timegenerated:1:19:date-rfc3339%Z

this will grab the first 19 characters of the timestamp (up to seconds)
and then the Z will be added (as it's outside the %)

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/

Lars.Peterson at cision

Jan 26, 2012, 9:39 AM

Post #2 of 2 (123 views)
Permalink

Re: Date formatting property options incompatible with SOLR DateField [In reply to]

David,

Love those 4 character fixes. Works perfectly now. Thank you so much!!!

-Lars

-----Original Message-----
From: rsyslog-bounces [at] lists [mailto:rsyslog-bounces [at] lists] On Behalf Of david [at] lang
Sent: Thursday, January 26, 2012 11:03 AM
To: rsyslog-users
Cc: jamesk [at] okeating
Subject: Re: [rsyslog] Date formatting property options incompatible with SOLR DateField

On Thu, 26 Jan 2012, Lars Peterson wrote:

> A date field shall be of the form 1995-12-31T23:59:59Z The trailing "Z" designates UTC time and is mandatory (See below for an explanation of UTC). Optional fractional seconds are allowed, as long as they do not end in a trailing 0 (but any precision beyond milliseconds will be ignored). All other parts are mandatory.
>
> I sniffed the wire to see what rsyslog is sending to SOLR and I see that the output (RFC-3339) is formatted like so:
>
> 2012-01-25T21:46:13.102571+00:00
>
> When I attempt to insert the document using this format I get an error:
>
> The request sent by the client was syntactically incorrect (ERROR: [doc=null] Error adding field 'generated'='2012-01-25T21:46:13.102571+00:00').
>
> I see 3 possible workarounds:
>
>
> 1) Add another property option to format the timestamp so that its compliant with ISO-8601 / Java DateField

this is the right option to take.

currently you are doing %timegenerated:::date-rfc3339%

change it to %timegenerated:1:19:date-rfc3339%Z

this will grab the first 19 characters of the timestamp (up to seconds) and then the Z will be added (as it's outside the %)

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads