0

I want to filter logs so that only messages from 13:00-14:00 can go through, how can I do that? I know I can access message content with $msg, but how can I do that for time?

Improve this question

1 Answer 1

Reset to default
0

You can extract the hour part of the timestamp using a regular expression [0-9]{2}:, but capture just the 2 digits by using () namely ([0-9]{2}):.

if re_extract($timestamp,"([0-9]{2}):",0,1,"xx")=="13" then /my/file

See RainerScript

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .