Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Date parsing, does not take slovene locale #111

Open
Mojster opened this issue Oct 13, 2017 · 1 comment
Open

Date parsing, does not take slovene locale #111

Mojster opened this issue Oct 13, 2017 · 1 comment

Comments

@Mojster
Copy link

Mojster commented Oct 13, 2017

Log entry:
SEARCH#Android#SLO#sikmb#BIB#sikmb#02-okt-2017 07:04:00.721#ADV##0#0#0#2#8#((šola AND luči)) NOT (DT=D) NOT RS=D and (DP=08 OR DP=XX) NOT NH=1

filter part from pipeline:

grok {
			match => {"message" => "%{DATA:act}\#%{DATA:interface}\#%{DATA:country}\#%{DATA:acronym}\#%{DATA:typeDB}\#%{GREEDYDATA:leftovers}"}
		}
		if [act] == "CONN" {
			drop { }
		}
		ruby {
			code => "event.set('acronym', event.get('acronym').upcase)"
		}
		
		mutate{
			split => {"leftovers" => "#"}
		}
		
		if [act] == "AUTH" {
			mutate{
				add_field => {
					"date" => "%{leftovers[1]}"
					"userID" => "%{leftovers[2]}"
				}
				remove_field => [leftovers]
			}
		} else if [act] == "DISP" {
			mutate{
				add_field => {
					"date" => "%{leftovers[0]}"
					"outputType" => "%{leftovers[1]}"
					"userID" => "%{leftovers[2]}"
				}
				remove_field => [leftovers]
			}
		} else if [act] == "SEARCH" {
			mutate{
#				WORKAROUND ŠUMNIKI
				add_field => {
					"url" => ""
					"date" => "%{leftovers[1]}"
					"mode" => "%{leftovers[2]}"
					"stZadetkov" => "%{leftovers[7]}"
				}
				merge => {"url" => "leftovers[9]"}
				remove_field => [leftovers]
			}
		} else if [act] == "RESR" or [act] == "PROL" or [act] == "CRES" {
			mutate{
				add_field => {
					"date" => "%{leftovers[1]}"
					"userID" => "%{leftovers[2]}"
					"serialNum" => "%{leftovers[3]}"
				}
				remove_field => [leftovers]
			}
		}
		
		date {
			locale => "sl-SI"
			match => ["date", "dd-MMM-YYYY HH:mm:ss.SSS"]
			timezone => "Europe/Ljubljana"
			target => "date"
		}
		
		mutate{
			join => {"url" => ""}
			add_field => {"inputType" => "MCOBISS"}
		}

My problem is, that my date 02-okt-2017 07:04:00.721 is written with using Slovenian locale
http://www.localeplanet.com/java/sl-SI/index.html

I've tried in the locale setting both option sl and sl_SI.
I'm using the latest LS 5.6.3.
I've posted this on ES discus, but because of the weekend ahead, I've decided to duplicate the post here.

Is there any option to process this or should I just do a gsub and just replace them?

@Mojster
Copy link
Author

Mojster commented Oct 16, 2017

Found a fix.

Date plugin does not suport Slovenian locale (sl, sl_SI, sl-SI) but a I found out with testing, it does support, Serbian (sr_Latn_RS) and the 3char months are identical.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant