nsmcp::AccessRecordParser method indexTime (public)

 <instance of nsmcp::AccessRecordParser> indexTime line

Defined in /usr/local/ns/tcl/nsmcp/access-record.tcl

Extract a bounded timestamp suitable for access-log indexing. Reject NUL-bearing or unsupported lines before deriving the record's index time.

Parameters:

line (required)

Raw physical log line to inspect.

Returns:

The index timestamp, or an empty result for an unusable line.

Testcases:

No testcase defined.

Source code:

if {[string first \x00 $line]>=0} {
    return {}
}
if {![regexp {^\S+\s+\S+\s+(?:"(?:[^"\\]|\\.)*"|\S+)\s+(\[[^\]\r\n]+\]|[0-9]+)\s+"(?:[^"\\\r\n]|\\.)*"\s+[1-5][0-9]{2}\s+(?:-|[0-9]+)(.*)$} $line -> stamp tail]} {
    return {}
}
set fields [regexp -all -inline {"(?:[^"\\]|\\.)*"} $tail]
set timing [:timingFields [string trim $stamp {[]}] $fields]
if {$timing eq "" || [dict exists $timing timeDependent]} {
    return {}
}
return [dict get $timing startTime]

XQL Not present:

Generic, PostgreSQL, Oracle