Date format failing in grok

Elastic Stack Logstash
1

We are using ELK 5.2 for Network device syslog Analytics . Some devices is sending date format with a special character "" in the beginning of date format for some reasons due to which grok is failing to match . Anyway i can ignore or match "" in logstash grok .Please advice .Details are below ..

Log :" <189>61: *Oct 10 11:03:44 SG: %OSPF-5-ADJCHG: Process 2, Nbr 1.2.5.6 on Tunnel15 from LOADING to FULL, Loading Done"

Date pattern : THETIMESTAMP %{MONTH} +%{MONTHDAY}(?: %{YEAR})? %{TIME} %{DATA:TZ}:

2

I assume you're talking about *. That's a metacharacter in regular expressions to if you want to match a literal one you have to escape it with a backslash.

3

Thanks ..Got it ..

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.