In the full context you will need the capture group (the original grammar is correct). If you can provide the specific input causing the error and the associated output (i.e., something like this works fine for me: [Sat Mar 14 23:42:45.990158 2015] [test:xyz] [pt 0:mnp 99] message) I will be better able to assist you.
Trink ---------- Forwarded message ---------- From: Madhukar Thota <[email protected]> Date: Sat, Mar 14, 2015 at 10:04 PM Subject: Re: [heka] Timestamp Conversion To: Michael Trinkala <[email protected]> Getting following error: error: FATAL: process_message() invalid key to 'next' Here is my lua script: local dt = require "date_time" local l = require 'lpeg' l.locale(l) local sp = l.space --local timestamp = l.P"[" * l.Cg(dt.build_strftime_grammar("%a %b %d %H:%M:%S.%s %Y") / dt.time_to_ns, "timestamp") * "]" local timestamp = l.P"[" * dt.build_strftime_grammar("%a %b %d %H:%M:%S.%s %Y") / dt.time_to_ns * "]" local md = l.P"[" * l.Cg(l.R('AZ','az','__')^1 , "module") * ":" * l.Cg(l.R('AZ','az')^1, "log_level" ) *"]" local pt = l.P"[" * l.P(l.R('az')^1) * sp * l.Cg(l.R('09')^1 ,"processid") * ":" * l.P(l.R('az')^1) * sp * l.Cg(l.R('09')^1 ,"threadid") *"]" local grammar = l.Ct(timestamp * sp * md * sp * pt * l.Cg( l.P(1)^0, "message" )) local msg_type = read_config("type") local payload_keep = read_config("payload_keep") local msg = { Timestamp = nil, Type = msg_type, Payload = nil, Fields = nil } function process_message () local log = read_message("Payload") local fields = grammar:match(log) if not fields then return -1 end --if fields.timestamp then msg.Timestamp = fields.timestamp fields.timestamp = nil --end if timestamp then msg.Timestamp = timestamp end if payload_keep then msg.Payload = log end msg.Fields = fields inject_message(msg) return 0 end On Sun, Mar 15, 2015 at 12:44 AM, Madhukar Thota <[email protected]> wrote: > Thanks for quick response. Let me try it. > > On Sun, Mar 15, 2015 at 12:07 AM, Michael Trinkala <[email protected]> > wrote: > >> Just remove the capture group and the timestamp variable will contain the >> value you want. >> >> local timestamp = l.P"[" * dt.build_strftime_grammar("%a %b %d >> %H:%M:%S.%s %Y") / dt.time_to_ns * "]" >> if timestamp then msg.Timestamp = timestamp end >> >> Trink >> >> On Sat, Mar 14, 2015 at 8:58 PM, Madhukar Thota <[email protected] >> > wrote: >> >>> I am trying to decode apache error logs using lua script. I was able >>> to extract the fileds i needed but having problem with time conversion. >>> >>> my log timestamp is in the following format : [Sat Mar 14 >>> 23:42:45.990158 2015] >>> >>> in my lua script, i am converting timestamp as follows: >>> >>> local timestamp = l.P"[" * l.Cg(dt.build_strftime_grammar("%a %b %d >>> %H:%M:%S.%s %Y") / dt.time_to_ns, "timestamp") * "]" >>> >>> and passing this timestamp filed to msg.Timestamp as follows: >>> >>> if fields.timestamp then >>> msg.Timestamp = fields.timestamp >>> fields.timestamp = nil >>> end >>> >>> But i am seeing the output as follows. >>> 2015/03/14 23:42:47 >>> :Timestamp: 1970-01-12 19:02:38 +0000 UTC >>> >>> Please let me know me how to convert the timestamp to actual timestamp >>> of log entry. >>> >>> _______________________________________________ >>> Heka mailing list >>> [email protected] >>> https://mail.mozilla.org/listinfo/heka >>> >>> >> >
_______________________________________________ Heka mailing list [email protected] https://mail.mozilla.org/listinfo/heka
