Dear Parser Gurus!
I have a question about using EVNTTIME function in a custom parser.
I have date format on the log like: 2018-03-21 09:30:10,004
I was able to convert it with <@event_time:*EVNTTIME($HDR,'%W-%M-%D %H:%T:%S',hdate,htime)>, but I miss the milliseconds.
Other timestamp is: 2018-02-23T09:56:14.616848Z where I also could not handle the part after the point.
<@event_time:*EVNTTIME($MSG,'%W-%M-%D %H:%T:%S',date,time)>
Can You give me a better solution?
Thank You in advance, Erika
esi esi tool parsing log parser
