Using milisecond timestamp with regex parser

Here developers can talk about how to write a Parser for LogMX

Moderator: admin

Post Reply
egol
Posts: 1
Joined: Thu Apr 16, 2020 4:04 pm

Using milisecond timestamp with regex parser

Post by egol » Thu Apr 16, 2020 4:12 pm

Hello,
In my log the time stamp is the number of milisecond from the time I started to run the program that produce the log.
For example:
21372 36105162 [Tmr Svc] [ERROR][WB_ZC208][36105162] ZC208_GetOverallStatus fail
Here the 36105162 stands for 10:01:45.162 (HH:mm:ss.SSS)

How can I make the parser do this conversion for me?

Thanks

Eyal

admin
Site Admin
Posts: 529
Joined: Sun Dec 17, 2006 10:30 pm

Re: Using milisecond timestamp with regex parser

Post by admin » Thu Apr 16, 2020 10:39 pm

Hello Eyal,

The issue with using just milliseconds is that by default, the reference time will be the UNIX epoch (i.e. Jan 1st 1970, 00:00), so instead of getting 20:00:00 you would get "Jan 1st 1970 20:00:00", and instead of 25:00:00 you would get "Jan 2nd 1970 01:00:00". And it would actually be even worse because of the timezone: UNIX epoch times are always using the UTC timezone. Which means that the expected "10:00:00" may actually be "Jan 1st 05:00:00" in your timezone.
So basically, absolute dates won't work with such dates using Regex Parsers. If you actually don't need absolute dates, and just need to compute the relative difference between two dates, you'll be fine using the date format "SSS". No matter what the reference date is, the difference between two dates will be interpreted as milliseconds, so for example, you'll be able to use the feature in menu "Tools" > "Compute elapsed time" when 2 log entries are selected.

But if you need to display "10:01:45.162" in the column "Timestamp" for the log date "36105162", then you will have to use a Java Class Parser instead of a Regex Parser. This smart Parser will convert the number of milliseconds in the desired string (which will not be a date BTW, but a duration). I can create one for you if you want. For that I will need to see your current Regex parser to know the fields you want to extract for each log entry (I'm not sure which part is the log message, and what the numbers/strings mean in these logs).

Let me know if you need my help :)

Xavier

Post Reply