LogParser - Support comma and dot as decimal mark

[gkuehn001]

Feature Request (Workaround)

The LogParser is not able to parse comma separated timestamps like "2017-12-10 12:05:11,962".
It would be helpful to add support for this timestamp format, since ISO 8601 defines the decimal separator as either "a comma or a dot".

Proposal:

As suggested by daniel the LogParser could substitute dot for comma while parsing the file.
See: https://community.influxdata.com/t/timestamp-format-error/3363

Current behavior:

If you try to parse a log file with entries (lines) like this ...

2017-12-11 11:11:33,591 successfulMatches=1

... with a telegraf.conf that looks like this ...

[[inputs.logparser]]
files = ["example.log"]
from_beginning = false
[inputs.logparser.grok]
	patterns = ['%{TIMESTAMP_ISO8601:timestamp:ts-"2006-01-02 15:04:05,000"} successfulMatches=%{NUMBER:successfulMatches:int}']

... you will get the following output:

2017-12-11T11:11:31Z I! Starting Telegraf v1.4.0
2017-12-11T11:11:31Z I! Loaded outputs: file
2017-12-11T11:11:31Z I! Loaded inputs: inputs.logparser
2017-12-11T11:11:31Z I! Tags enabled: host=PC1
2017-12-11T11:11:31Z I! Agent Config: Interval:10s, Quiet:false, Hostname:"PC1", Flush Interval:10s
2017-12-11T11:11:33Z E! Error parsing 2017-12-11 11:11:33,591 to time layout [2006-01-02 15:04:05,000]: parsing 
time "2017-12-11 11:11:33,591" as "2006-01-02 15:04:05,000": cannot parse "591" as ",000"
logparser_grok,host=PC1,path=example.log successfulMatches=1i 1512990693592554600

Desired behavior:

Timestamps like "2017-12-10 12:05:11,962" should be parsed by the Telegraf LogParser. Parsing error should not appear.

Use case: [Why is this important (helps with prioritizing requests)]

Logfiles written by third party applications cannot be parsed if they use commas instead of dots to separate fractions of seconds. Since ISO 8601 defines that "a comma or a dot" can be used as a decimal mark, the Telegraf LogParser should support this.

[crazy-canux]

There is a workaround.
You can use string instead of ts.

[danielnelson]

True, though everything will be collected at time == now()