Hi,
I'm trying to match timestamp from log file and i have an _dateparsefailure
This is my grok pattern (it match) :
grok {
match => { "message" => ["\[(?<logtimestamp>%{MONTHDAY}-%{MONTH}-%{YEAR}\s+%{TIME})\] %{DATA:level}:\s?(?:\[%{DATA:pool}\])?\s?%{GREEDYDATA:infos}"] }
}
my date filter:
date {
locale => "fr"
timezone => "Europe/Paris"
match => [ "logtimestamp", "dd-MMM-yyyy HH:mm:ss" ]
}
(I already try without locale and timezone set)
an example of input:
[15-Jan-2017 16:53:35] WARNING: Too many warnings call warning owner.
And the result of :
{
"logtimestamp" => "15-Jan-2017 16:53:35",
"@timestamp" => 2017-09-15T20:20:29.133Z,
"level" => "WARNING",
"@version" => "1",
"infos" => "Too many warnings call warning owner.",
"tags" => [
[0] "_dateparsefailure"
]
}
As you see, my match fail... Do I miss something ?
Thanks for your future answers
Samuel.