Parsing journalctl datetime format (unix timestamp and ISO)

[pacien]

(Yet another question regarding log parsing format...)

I'm using journald/journalctl to manage my logs.
I'm having issues parsing its datetime formats in GoAccess.

For journalctl --output short-unix,
producing 1704646003.544462:

--log-format='%x ...'
--datetime-format='%*'

Or

--datetime-format='%f'

Give:

==3837251== Token '1704646003.544462' doesn't match specifier '%x'

For journalctl --output short-iso,
producing 2024-01-07T17:46:43+0100:

datetime-format='%Y-%m-%dT%H:%M:%S+%z'

Gives:

==3838490== Token '2024-01-07T17:46:43+0100' doesn't match specifier '%x'

Running GoAccess v1.8.

[pacien]

For short-iso, %z already "contains" the leading + (or -).
So the correct datetime-format for this is instead:

datetime-format='%Y-%m-%dT%H:%M:%S%z'

I couldn't manage to get the right format for short-unix though.

[allinurl]

This should bring you closer to your desired outcome.

echo 'google.com:80 ::1 - - [1704646003.544462] "OPTIONS * HTTP/1.0" 200 136 "-" "Apache (internal dummy connection)" 172' | goaccess - --log-format='%v:%^ %h %^[%x.%^] "%r" %s %b "%R" "%u" %D' --date-format=%s --time-format=%s --date-spec=min