I have a hive-server2 log that's formatting its output with timestamps like:
2017-09-19T18:04:39,717 ERROR [words.
But the datetime_format spec doesn't list any support for milliseconds. There is only zero padded microseconds %f -> 000000 ... 999999.
So I tried to specify most of the string as follows:
datetime_format = %Y-%m-$dT%H:%M:%S,
But I'm getting parse warnings for this in the /var/log/awslogs.log. It would appear that it's trying to use the format to match the whole first white-space separated field, or maybe using it to find where to start splitting on whitespace and then expecting the 717 part to be a log level.
Does anyone know which it is and also whether there's some way for me to write a regex equivalent of .*, \d* or \S* for after the comma?