Custom Time field doesnot contain any data after create in grok pattern

Elastic Stack Logstash
1

I have written follow grok pattern in logstash

filter{

  grok{
    match  =>  { "message" => '%{IPORHOST:clientip} %{HTTPDUSER:ident} %{USER:auth} \[%{HTTPDATE:logtimestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes:int}|-)' }


}

  date{ match => ["logtimestamp","DD/MMM/YYYY:HH:MM:SS ZZ","ISO8601"] target => "Time" }
}

As you can see I don't want to use default timestamp abut want to use Time as field name and use it as timestamp actually this field has created but it does not contain any data . what is the issue ?

2

If is this format: [07/May/2024:13:47:19 +0530], should be something like this:

date{ 
match => ["logtimestamp","dd/MMM/yyyy:HH:mm:ss ZZ"]
target => "Time" 
}
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.