search

logstash-plugins / logstash-filter-date

Apache License 2.0
7 stars 43 forks source link

Apache HTTPD ISO 8601, including micro-seconds #108

Open tomsommer opened 7 years ago

tomsommer commented 7 years ago

"ISO8601" doesn't support this format provided by Apache HTTPD:

%{cu}t | The current time in compact ISO 8601 format, including micro-seconds

https://httpd.apache.org/docs/2.4/mod/core.html#errorlogformat

returns 2017-10-02 16:10:52.118921 (example)

Format is yyyy-MM-dd HH:mm:ss.SSSSSS

jordansissel commented 7 years ago

I wonder if we should just remove the ISO8601 shorthand. It confuses a lot of folks.

I recommend you use the format you provided instead of the ISO8601 shorthand.

The formats the ISO8601 shorthand supports are these:

https://github.com/logstash-plugins/logstash-filter-date/blob/bc7918f22fc0919bed8175e1b65d0d179ffc7a35/src/main/java/org/logstash/filters/parser/CasualISO8601Parser.java#L40-L44

Adding more will likely add latency (every format failure incurs a cost and wasted resources) -- so my recommendation remains that you be specific with your format and use the one you provided.

tomsommer commented 7 years ago

Duly noted, it is indeed confusing that ISO8601 is apparently so loose, and/or open to interpretation.

jordansissel commented 7 years ago

Filed https://github.com/logstash-plugins/logstash-filter-date/issues/109 to discuss removing the confusing iso8601 keyword.