Dateparsefailure - Mac Syslogs

(Tim Beekley) #1


Brand new to the Elasticstack, I have a question about date filtering. Here's the sample message:

May 3 14:08:41 foo-hostname[1] ( Service only ran for 0 seconds. Pushing respawn out by 10 seconds.

Here's the filter from my yml file:

filter {
    match => [ "message", "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{GREEDYDATA:syslog_message}" ]
  date {
    match  => [ "syslog_timestamp", "MMM dd HH:mm:ss" ]

It's giving me a dateparsefailure tag and I can't seem to figure out why...



(Magnus B├Ąck) #2

You use "dd" in your pattern but the day of month (3) is only one character long. You need to list two patterns in your filter; one with "dd" and one with "d".

(Tim Beekley) #3

That was it! Thanks!

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.