My solution was to use %d{yyyy-MM-dd'T'hh:mm:ss.SSSZZZZ}
How to log the correct timezone with log4j which is parsable by logstash
Pregunta
I have problems logging the correct datetime in log4j and parse it with logstash.
I set up a tomcat with log4j (1.2.17) and a little application which just produces some logs.
I logged the time with %d{ISO8601}
The result was that the timezone was missing and logstash thought it was UTC, because i parsed it with.
date {
type => "tomcat"
match => [ "orig_timestamp", "ISO8601"]
}
After that I tried the following:
<layout class="org.apache.log4j.PatternLayout">
<param name="ConversionPattern" value="%d{ISO8601}%d{Z} %-5p %50.50c - %m%n" />
</layout>
but that resulted in following error in logstash:
{:timestamp=>"2013-10-17T19:13:12.977000+0200", :message=>"Failed parsing date from field", :field=>"orig_timestamp", :value=>"2013-10-17 19:00:02,059+0200", :exception=>java.lang.IllegalArgumentException: Invalid format: "2013-10-17 19:00:02,059+0200" is malformed at " 19:00:02,059+0200", :level=>:warn}
I think the :
are missing in the offset. But how can I do it without all that manual try and error? Cant I just say print iso8601 with timezone and parse ISO8601 with timezone?
Solución 2
Otros consejos
Slight amendment to the above answer, I think the hours need to be HH instead of hh to make them support the 24 hour clock.
%d{yyyy-MM-dd'T'HH:mm:ss.SSSZZZZ}
Licenciado bajo: CC-BY-SA con atribución
No afiliado a StackOverflow