timestampdatadog

Date parsing in datadog logs

This is a partial of a log entry in datadog:

"[2024-08-29 11:19:00,049] snipeit INFO {'byod': False...}"

I'm just trying to parse the date and then the logname and then the json that comes after that.

This is my parsing rule:

parsing_rule \[%{date("yyyy-MM-dd HH:mm:ss.SSS z"):date}\] %{word:logname} %{notSpace:INFO} %{data::json}

It delivers no matches and I'm not sure why?

Solution

  • your parsing rule should look like:

    parsing_rule \[%{date("yyyy-MM-dd HH:mm:ss,SSS"):date}\] %{word:logname} %{notSpace:INFO} %{data::json}

    Your date has no time zone in it, so you don't need the z, also your input date has a , not a . to separate out the milliseconds.

    enter image description here

    This will work, but notice the json isn't being parsed, this is because your example snippet is invalid json. you need to use double quotes to define strings, and boolean values are all lower case, so False would be invalid. the string would need to look like {"byod":false} to be properly parsed.