Help on format

[TerDale]

I'm trying to configure format to read logs formatted as follows:

2024-04-10T16:54:45:828+0200 TRACE {thread-name} tld.company.product.package.subpackage.ClassName:67 Some message here

However for all my attempts, I end up with the dreaded: Failed to read log, Incorrect log format

As these are log4j logs, I first tried with this:

format = {
type: Log4jLogFormat
pattern: "%date{yyyy-MM-dd_HH:mm:ss.SSS} %-5level %thread %logger{35} %msg%n"
charset: UTF-8
locale: en_US
customLevels: ["XXX", "YYY"]
}

As it failed, and as I didn't find how to specify the 'T' between date and time, and the zone after ms, I tried the following regex format:

format = {
type: RegexLogFormat
regex: "(?<date>\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}\+\d{4}) +(?<level>[A-Z]+) +(?<thread>\{.+\}) +(?<logger>[\p{javaJavaIdentifierPart}.]+:\d+) (?<msg>.+)"
charset: UTF-8
fields: [
{ name: "date", type: "date" },
{ name: "level", type: "level/log4j" },
{ name: "logger", type: "class" },
{ name: "msg", type: "message" },
{ name: "thread", type: "thread" },
]
}

But it doesn't work either....

Could someone help with to find what's wrong?

[sevdokimov]

The right format is pattern: "%date{yyyy-MM-dd'T'HH:mm:ss:SSSX} %-5level %thread %logger{35}:%line %msg%n".

'T' separator can be specified using 'T'. Your pattern has . separator between seconds and milliseconds, but the log has :. Also you didn't specified timezone (X).
There is a line number after the class name, so I added :%line after %logger{35}

[TerDale]

@sevdokimov thanks for fixing my errors, it works now!