My logs entries look like that:
<<DEBUG>> **[Mar 01 14:55:18]** [[ACTIVE] ExecuteThread: '5' for queue: 'weblogic.kernel.Default (self-tuning)'] [CM] [OMS] (BasicParameter.getEffectiveDate) Exit
<<DEBUG>> [Mar 01 14:55:18] [[ACTIVE] ExecuteThread: '5' for queue: 'weblogic.kernel.Default (self-tuning)'] [CM] [OMS] (BasicParameter.getExpirationDate) Enter
I need to use the date as timestamp.
Following the code from my logstash.conf file:
multiline {
patterns_dir => "/users/mpswrk1/LogStash/impls/patterns/patterns"
pattern => "^\<\<%{LOGLEVEL}\>\> "
negate => true
what => "previous"
}
grok {
match => { "message" => "\<\<%{LOGLEVEL:severity}\>\> \[%{PARTTIMESTAMP:timestamp}\] \[\[%{DATA:status}\] %{DATA:execute_thread}\] \[%{WORD:source_app}\] \(%{JAVACLASS:method}\) %{DATA:exception_method_description}\: \(%{DATA:error_code}\) %{DATA:error_description}%{JAVASTACKTRACEPART:java_class_stack}" }
patterns_dir => "/users/mpswrk1/LogStash/impls/patterns/patterns"
}
date {
match => [ "timestamp" , "MMM dd, yyyy hh:mm:ss aa" ]
}
*parttimestamp is a private
PARTTIMESTAMP %{MONTH} %{MONTHDAY} %{TIME
Regards
Sharon.