Graylog2 / Graylog2/graylog2-server

Issue with epoch timestamp being converted to datetimestamp

Open
#2,409 4 comments 0 reactions 0 assignees View on GitHub
bug processing triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

### Problem description

I have a grok pattern that sets an EPOCH based timestamp to a variable. I
now want modify that grok to transform that EPOCH to a date time and its is failing.

When doing this is the UI I get this error
metrictimestamp_grokfailure
java.text.ParseException: Unparseable date: "1466210640000"
### Steps to reproduce the problem

Sample: String

16/06/18 00:33:59 WARN InfluxDBQuarantineHandler: Message quarantined! Reason: Invalid - reading time ahead of current clock time, Msg: 47314fd5-5468-4d9e-b051-30015a474916.515e02c2108c193c32b4da2e506980ad-CAT.60d23a73-7223-45f6-b15f-86797e3d342a.1a8ae4fa-1189-4649-a4a3-7fec95d5c890 1466210640000 0.0

Grok Pattern:
%{DATESTAMP:insertdate} %{WORD:logstatus} %{WORD:influx}: (?[a-zA-Z]_\s[a-zA-Z]_)! (?._), Msg: (?\w_-\w_-\w_-\w_-\w_).(?\w_-CAT).(?\w_-\w_-\w_-\w_-\w_).(?\w_-\w_-\w_-\w_-\w_) %{DATA:metrictimestamp;date;dd/MMM/yyyy:HH:mm:ss Z} (?._)
### Environment
- Graylog Version: 2.0.1 (81e0187), codename Rothaus
- Elasticsearch Version: 2.3.2-1
- MongoDB Version: 3.2.4
- Operating System: Centos 7.1
- Browser version: Safari 9.1.1

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.