How to parse WPP format timestamps ?

Question

hi,
Trying to use messageanalyzer for our custom log files.  We log the timestamp in the same format as WPP traces do (for legacy tools).
e.g:
06/03/2014-16:10:57.854
How do I indicate in my config that the timestamp is in this format  ? As it stands if I set IsTimeStamp=true, analyzer fails to parse the field as a datetime.

Answer 1

The format for Timestamp is pretty strict.  But you can parse the data using a syntax statement that extracts the date/time from the current string. 
In this example, the date is split in two.  For your example, you could just parse the same string twice for each part.  Then a property, SCCMtsDateTime, sets the IsTimeStamp aspect and takes a Base message as the type.  If you derive your
message from that base type, as in the example at the end.
// Base type for all messages
message BaseTimeStamp : LogEntry
 string Time;
 string Date;
// Syntax creates a type based on an regex expression
// time="17:24:35.005+300" date="07-08-2013"
syntax CustomDateTimeFormat = month:regex{[0-9][0-9]} "-" day:regex{[0-9][0-9]} "-" year:regex{[0-9]+} " " hours:regex{[0-9][0-9]} ":" minutes:regex{[0-9][0-9]} ":" seconds:regex{[0-9][0-9]} "." fract:regex{[0-9]+} "+" tz:regex{[0-9]+}
        => ToDateTime(year + "-" + month + "-" + day + "T" + hours + ":" + minutes + ":" + seconds + "." + fract + "+" + tz);
// Property to return date type given a message of type BaseNetLogon.  Aspects for IsTimestamp allow you to replace the timestamp value.
DateTime get SCCMtsDateTime(this BaseTimeStamp msg) with EntryFieldInfo {IsTimestamp = true, IsLocalTime = false }
 //optional DateTime theDateTime = CustomDateTimeFormat(msg.Date + " " + msg.Time);
 optional DateTime theDateTime = (msg.Date + " " + msg.Time).ToDateTime();
    if(theDateTime == nothing)
  return CustomDateTimeFormat("01/07/1968 12:34:56.987+500") as DateTime;
    else
  return theDateTime as DateTime;
message SCCMLine with
 EntryInfo {
  Regex = @"^<!\[LOG\[(?<Message>.*)\]LOG]!><time=""(?<Time>.{16})"" date=""(?<Date>.{10})""\scomponent=""(?<Component>.*)""\scontext=""(?<Context>.*)""\stype=""(?<Type>.*)""\sthread=""(?<ThreadId>.*)""\sfile=""(?<File>.*):(?<LineNumber>.+)"">"//,
Tag = "]LOG]"
 : LogEntry
 string Time;
 string Date;
Hopefully this helps,
Paul