Updated at: 2022-12-09 03:49:50
Using timestamp parsing, the time of log generation or the time of system entry can be changed to timestamp format recognizable by system to facilitate subsequent operations.
When configuring timestamp parsing rules, you can fill in multiple time formats to match, separated by semicolons. The system will try to match in sequence until a time format is successfully matched, and the time format will be finally adopted, as follows:
Description of parameters in Timestamp Parsing:
► Language: According to the sequence format of month or weekday in the text to be parsed, select Chinese/English for paring. For example, in case of month or weekday in English, select English;
► Time Format:
► Default Timezone: It is to solve the problem of inaccurate time display during log searching when there is no timezone information in the log data.
• If there is no timezone information in the text for timestamp parsing, the value of Default Timezone is recognized by the browser currently used;
• If there is timezone information in the text for timestamp parsing, the default value will be automatically matched to the timezone information in the text.
► Timestamp: You can optionally create @timestamp for search filtering if there are multiple timestamps in the parse rule.
When configuring timestamp parsing rules, you can fill in multiple time formats to match, separated by semicolons. The system will try to match in sequence until a time format is successfully matched, and the time format will be finally adopted, as follows:
Description of parameters in Timestamp Parsing: ► Language: According to the sequence format of month or weekday in the text to be parsed, select Chinese/English for paring. For example, in case of month or weekday in English, select English;
► Time Format:
| Timestamp Example | Timestamp Parsing |
| 12-1-1 2:5:5 | YY-M-d H:m:s |
| 2011-04-19T03:44:01.103 | ISO8601 |
| Jan 2, 2017 | MMM d,YYYY |
| Monday July 2016 | dddd MMMM YYYY |
| 15/January/2019 Tuesday | dd/MMMM/yyyy EEEE |
• If there is no timezone information in the text for timestamp parsing, the value of Default Timezone is recognized by the browser currently used;
• If there is timezone information in the text for timestamp parsing, the default value will be automatically matched to the timezone information in the text.
► Timestamp: You can optionally create @timestamp for search filtering if there are multiple timestamps in the parse rule.
< Previous:
Next: >