I have a log that has time expressed like this 20151218111015. So that would be December 18th, 2015 11:10:15. However, sometimes it doesn't have the seconds. So, the props.conf TIME_FORMAT could be either %Y%m%d%H%M%S or %Y%m%d%H%M. If I put in the firs then the events without seconds don't get the correct time ... they just get the time that the event was indexed. If I put in the second, then none of my events have seconds. Is there any way around this? I would like it to keep the seconds if they exist.
↧