#9 Unable to detect date format from nginx log files

Fermé
créé il y a 7 ans par matorban · 1 commentaires
matorban a commenté il y a 7 ans

HOST - - [29/Sep/2015:19:52:02 +0200] “GET http://blabla HTTP/1.1” 200 4551 “-” “sfFeedReader/0.9”

This kind of format (nginx servor log) seems to not support by ttail. I get some huge anonymize log for test..

HOST - - [29/Sep/2015:19:52:02 +0200] "GET http://blabla HTTP/1.1" 200 4551 "-" "sfFeedReader/0.9" This kind of format (nginx servor log) seems to not support by ttail. I get some huge anonymize log for test..
yannweb a référencé ce problème depuis une révision il y a 7 ans
yannweb a commenté il y a 7 ans
Propriétaire

Thank’s for the comment.

In fact ttail was not able to autodetect nginx date format. But the programm should work using those options :

ttail -Er “^[^[]+[” -f “%d/%B/%Y:%H:%M:%S” -d “#-1h” /path/to/logs/access.log

There was 2 reason for autodetection not working problem :

  • the format “%d/%B/%Y:%H:%M:%S” is not in the list of format that ttail will try when autodetecting formats
  • there is a prefix before the date

I added the “%d/%B/%Y:%H:%M:%S” to the list of formats (in src/include/ttail.h ), but you will still have to give the -E -r prefix arguments !

Thank's for the comment. In fact ttail was not able to autodetect nginx date format. But the programm should work using those options : <pre> ttail -Er "^[^\[]+\[" -f "%d/%B/%Y:%H:%M:%S" -d "#-1h" /path/to/logs/access.log </pre> There was 2 reason for autodetection not working problem : - the format "%d/%B/%Y:%H:%M:%S" is not in the list of format that ttail will try when autodetecting formats - there is a prefix before the date I added the "%d/%B/%Y:%H:%M:%S" to the list of formats (in src/include/ttail.h ), but you will still have to give the -E -r prefix arguments !
Connectez-vous pour rejoindre cette conversation.
Aucun jalon
Pas d'assignataires
2 participants
Échéance

Aucune échéance n'a été définie.

Dépendances

Ce ticket n'a actuellement pas de dépendance.

Loading…
Annuler
Enregistrer
Il n'existe pas encore de contenu.