Logparser custom timestamp error

Telegraf
1

Telegraf 1.5.2

String to parse ‘2016-02-09T13:27:40.734-0500 6193.814’

Grok patterns = [’%{TIMESTAMP_ISO8601:timestamp:ts-“2006-01-02T15:04:04.000-0700”} %{NUMBER:elapsed:float}’]

Output ‘elapsed=6193.814 1455043200734000000’

But the timestamp is wrong: 1455043200734000000 => Tuesday, February 9, 2016 1:40:00.734 PM GMT-05:00
Seconds are 00 instead of 40
Minutes are 40 instead of 27

Moreover with this configuration, same CUSTOM time layout but different values:
patterns = [’%{TIMESTAMP_ISO8601:timestamp:ts-“2018-02-09T11:44:31.155-0500”} %{NUMBER:elapsed:float}’]

This error happens:
Error parsing 2016-02-09T13:27:40.734-0500 to time layout [2018-02-09T11:44:31.155-0500]: parsing time “2016-02-09T13:27:40.734-0500”: month out of range

Any help appreciated

2

You must use the so called “reference time” when specifying the parse timestamp. It must be specifically this time, not just a time in this format, and is defined as:

Mon Jan 2 15:04:05 MST 2006

To parse your time you would use

%{TIMESTAMP_ISO8601:timestamp:ts-“2006-01-02T15:04:05.999-0700”

There is more information about this in the Go documentation.

3

It works, thank you very much for the clarification.