Need to write a regex for time extraction

[Praz_123]

Need to write a regex for  same as time and same as event given below in image 

[livehybrid]

Hi @Praz_123 

Did the time extraction I provided in the previous thread not work for you for some reason?

TIME_PREFIX="ds":\s"
TIME_FORMAT=%Y-%m-%dT%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD=20

The reason for your error is the extra "." you have in your TIME_PREFIX which is causing it to skip the first character of the year. Also you need to specify the MAX_TIMESTAMP_LOOKAHEAD.

Below is my previous response incase you missed it.

---

@livehybrid wrote:

[yourSourceType]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\S\s\n]+"predictions":\s\[\s*)|}(\s*\,\s*){|([\s\n\r]*\][\s\n\r]*}[\s\n\r]*)
NO_BINARY_CHECK=true
TIME_PREFIX="ds":\s"
TIME_FORMAT=%Y-%m-%dT%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD=20

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

---

[kiran_panchavat]

@Praz_123 

Let me try in my lab and get back to you shortly. 

[Praz_123]

@kiran_panchavat 

Same data would be like :-

{
"version": "200",
"predictions": [
{
"ds": "2023-01-01T01:00:00",
"y": 25727,
"yhat_lower": 23595.643771045987,
"yhat_upper": 26531.786203915904,
"marginal_upper": 26838.980030149163,
"marginal_lower": 23183.715141246714,
"anomaly": false
},
{
"ds": "2023-01-01T02:00:00",
"y": 24710,
"yhat_lower": 21984.478022195697,
"yhat_upper": 24966.416390280523,
"marginal_upper": 25457.020250925423,
"marginal_lower": 21744.743048120385,
"anomaly": false
},
{
"ds": "2023-01-01T03:00:00",
"y": 23908,
"yhat_lower": 21181.498740796877,
"yhat_upper": 24172.09825724038,
"marginal_upper": 24449.705257711226,
"marginal_lower": 20726.645610860345,
"anomaly": false
},

[kiran_panchavat]

@Praz_123 

\b\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.000)?\b

[Praz_123]

@kiran_panchavat 
am getting the error as I need the same date and time extraction while using the time format and time prefix am getting the below error 

Below is my props.conf 

[ _json ]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\S\s\n]+"predictions":\s\[\s*)|}(\s*\,\s*){|([\s\n\r]*\][\s\n\r]*}[\s\n\r]*)
NO_BINARY_CHECK=true
TIME_FORMAT=%Y-%m-%dT%H:%M:%S
TIME_PREFIX=\[|ds\"\:\s\".

[kiran_panchavat]

@Praz_123 

Check this

[Praz_123]

@kiran_panchavat 

Not working for me are you using different event breaks and timestamp 

I used the below props.conf 

[ <SOURCETYPE NAME> ]
CHARSET=AUTO
SHOULD_LINEMERGE=true
LINE_BREAKER=([\r\n]+)
TIME_FORMAT=%Y-%m-%dT%H:%M:%S
TIME_PREFIX= "ds":\s*"

[kiran_panchavat]

@Praz_123 

Check the data which you uploaded it should be .json format not .txt format. 

[ jsontest ]
CHARSET=UTF-8
LINE_BREAKER=([\S\s\n]+"predictions":\s\[\s*)|}(\s*\,\s*){|([\s\n\r]*\][\s\n\r]*}[\s\n\r]*)
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=true
category=Custom
pulldown_type=true

[Praz_123]

@kiran_panchavat 


Same issue again if I take in json or in txt both are not giving me results 

[livehybrid]

Hi @Praz_123 @kiran_panchavat 

You need to set MAX_DAYS_AGO=5000 and MAX_TIMESTAMP_LOOKAHEAD=20

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[kiran_panchavat]

@Praz_123 

Select source type something like, I can see it's showing default

********* Ignore this *****

[Praz_123]

@kiran_panchavat 

I got the answer thanks as I used the below props.conf  , @livehybrid  thanks for your help 

[ <SOURCETYPE NAME> ]
LINE_BREAKER=([\S\s\n]+"predictions":\s\[\s*)|}(\s*\,\s*){|([\s\n\r]*\][\s\n\r]*}[\s\n\r]*)
NO_BINARY_CHECK=true
TIME_FORMAT=%Y-%m-%dT%H:%M:%S
TIME_PREFIX="ds":\s"
MAX_TIMESTAMP_LOOKAHEAD=20
MAX_DAYS_AGO=5000