4.3.10 Timestamp

There a two different timestamp layouts. Their XML files have the following names:

  • “Timestamp.xml”

  • “Timestamp_extracted.xml”

Both layouts use regular expressions to identify a wide range of timestamps. The “Timestamp.xml” layout uses a grammar to identify timestamps whereas the “Timestamp_extracted.xml” layout identifies the timestamps in the custom columns definition. The “Timestamp.xml” layout only identifies timestamps which are located at the beginning of a log record. The “Timestamp_extracted.xml” layout can identify timestamps at any position in a log record. The identified timestamps will be displayed in their own column. Only the first timestamp of a line is identified and considered to be part of the header. If there are more timestamps in the line they belong to the log's description.

The timestamps should have the same order for year, month and day in the date. Otherwise the ISO_TIMESTAMP column might be inconsistent (see Custom Columns Definitions (CCD), ISO_TIMESTAMP column and option SourceTimestampFormat).

Both layouts identify timestamps of the following formats:

The date can start with the year or with the day and the year can consist of two or four digits. Month and day must consist of two digits. Year, month and day must be separated either by slashes or dots or hyphens. Time and date must be separated by a single white space. Hour, minute and second must consist of two digits which are separated by a colon. Milliseconds are optional. If they exist they must consist of three digits and they must be separated by a dot or a comma from the seconds. Some examples of supported timestamp formats are shown in example Some supported timestamp formats.

Notation: Y=Year, M=Month, D=Day, h=hour, m=minute, s=second, m=millisecond

YYYY-MM-DD, hh:mm:ss,mmm

YY/MM/DD, hh:mm:ss.mmm

DD.MM.YY, hh:mm:ss

DD-MM-YYYY, hh:mm:ss

Example 1: Some supported timestamp formats

Open both the ISO_TIMESTAMP and the TIMESTAMP column in the Log window and display them next to each other. So you can easily compare the format of the original timestamps from the logs and the ISO timestamp format.