timestamp-format vs timestamp-format#

[paul....@gmail.com]

Hi there,

Why is it that timestamp-format has a hash appended to it in the code? Why is that not reflected in the documentation? What purpose does it serve?

Thanks in advance,

Paul

[Timothy Stack]

On Mon, Jun 29, 2015 at 6:40 PM, <paul....@gmail.com> wrote:

Hi there,

Why is it that timestamp-format has a hash appended to it in the code?  Why is that not reflected in the documentation?  What purpose does it serve?

​Short answer: ​it means it's an array of values.  So, the path '/foo' would match the

following json:

  { "foo" : 1 }

And, '/foo#' would match:

  { "foo" : [1, 2, 3] }

Long answer: lnav uses yajl in streaming mode to read the format json files rather

than loading the file into a big object and operating on that.  In streaming mode,

yajl will call the handler for each type with just the given value, but it's not going to

help put that value in context.  So, we need a way to keep track of where we are

in the file.  The yajlpp.hh [1] wrapper is an experiment I wrote that does the job of

keeping track of where we are in the file by building a path and then it triggers any

callbacks that match that path.  For example, the format loader will uses the

following regex to match the boolean fields in a config:

  ^/\w+/(json|convert-to-local-time|epoch-timestamp)$

 

If a match is found, it calls the read_format_bool function in log_format_loader.cc.

The full list of paths/handlers for a format is here[2].

Thanks in advance,

Pau

​l

​tim

[1] - https://github.com/tstack/lnav/blob/master/src/yajlpp.hh

​[2] - https://github.com/tstack/lnav/blob/master/src/log_format_loader.cc#L375

​

[paul....@gmail.com]

On Tuesday, 30 June 2015 14:32:08 UTC+10, Timothy Stack wrote:
>
> ​Short answer: ​it means it's an array of values.

Ah.... So when I skipped over the bit in the doco which said "An array of timestamp formats", I was missing something useful? That doesn't sound like me at all!

Sorry about that! Thanks for your patience!

Have fun,

Paul

[paul....@gmail.com]

OK, I need a bit more of that patience. I'm trying to use:

"timestamp-format" : [ "%a %b %e %H:%M:%S %Z %Y" ],

On lines like:

"line" : "Fri Apr 17 15:13:15 AEST 2015 Info: Installing /lib64/libc-2.12.so"

If I include the timestamp-format, I get:

error:dracut_log:unrecognized timestamp format -- Fri Apr 17 15:13:15 AEST 2015 Info: Installing /lib64/libc-2.12.so
...
format: %a %b %d %H:%M:%S %Z %Y; matched: Fri Apr 17 15:13:15 AEST 2015
...

Which looks like it matched the entire timestamp. My pattern including %e isn't mentioned at all in the list of formats its using.

If I remove that timestamp-format line from my description, it works, but I get weird dates - using 'p' on a log line gives:

Fri Jun 26 14:39:53 AEST 2015 Info: Stripping '/tmp/initramfs.wIHD1f/bin/ln'
Current Time: 9486-06-26T14:39:53.000 Original Time: 9486-06-26T14:39:53.000 Offset: +0.000

So I'm not sure why it thinks the log lines come from year 9846, but the other fields in the time are correct.

Any idea what might be going wrong here?

Thanks in advance,

Paul

[Timothy Stack]

Sorry, it looks like it was a bug in lnav.  I didn't do a good job on fleshing

out support for custom timestamps.  I've pushed a change[1] that should fix the issue

if you are able to update to the top-of-tree.

thanks for the report,

tim

​[1] - https://github.com/tstack/lnav/commit/4ceddbe82e00e0d78f224fe576bc330b641f75d5​

Paul

--
You received this message because you are subscribed to the Google Groups "lnav" group.
To unsubscribe from this group and stop receiving emails from it, send an email to lnav+uns...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.