Auto parsing of dates in Tomcat logs

Follow

Pablo León

• June 23, 2015 18:04

I'm testing the service.
Uploaded a logs with entries like this:
2015-06-19 18:30:01.151 ERROR [alfresco.solr.AlfrescoSolrEventListener] [pool-3-thread-1] Incorrect ACL set662283 CacheEntry [dbid=116145, leaf=0, path=662283, aclid=0, owner=0]
java.lang.IllegalStateException: Cache position check failed

But all 80,000 entries went into the same time bucket, the upload time.
How to get SL auto recognize the timestamps on the lines?

I uploaded those files as Apache logs.
Then installed the "Tomcat App".
But no idea how to tell SL that those logs are from tomcat.

regards
- pablo

0

• 

  Kevin Keech

  • June 23, 2015 18:17

  Hi Pablo,

  Sumo Logic should be able to automatically parse that timestamp format from your logs. Can you show us a quick screenshot of the results of your query for this "_source?" Showing the log time and the parsed time from the query? Looking at our backend it looks like the Source received logs with timestamps between the following times. (in PDT) So the messages should not be showing within one time bucket.

  06/19/2015 06:21:32:005 to 06/19/2015 14:30:01:151

  0

  Comment actions Permalink

Please sign in to leave a comment.