.*)"
]
}
#Parsing out timestamps which are in timestamp field thanks to previous grok section
date {
match => ["timestamp" , "yyyy-MM-dd HH:mm:ss.SSS"]
}
}
output {
if " ERROR " in [message] {
elasticsearch {
hosts => ["elasticsearch:9200"]
index => "errors_prima"
}
} else {
elasticsearch {
hosts => ["elasticsearch:9200"]
index => "others_prima"
}
}
stdout { codec => rubydebug }
}
```
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [October 4, 2022, 3:30pm UTC](https://discuss.elastic.co/t/extract-originals-timestamp-from-logs/315798/2 "2022-10-04T15:30:34Z")
Yes, use comma, not dot. If you not force target, will not get an error \_dateparsefailure.
```auto
date {
match => ["message", "yyyy-MM-dd HH:mm:ss,SSS"]
# target => "@timestamp"
# timezone => "Europe/Berlin"
}
```
Tested on LS 8.4
---
### Author:  [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)
#### Post date: [October 4, 2022, 3:43pm UTC](https://discuss.elastic.co/t/extract-originals-timestamp-from-logs/315798/3 "2022-10-04T15:43:53Z")
tnx
but grok section is correct ?
---
### Author:  [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)
#### Post date: [October 4, 2022, 4:22pm UTC](https://discuss.elastic.co/t/extract-originals-timestamp-from-logs/315798/4 "2022-10-04T16:22:32Z")
```auto
[2022-10-04T16:20:27,484][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:prima,
:exception=>"LogStash::ConfigurationError", :message=>"Expected one of [\\t\\r\\n], \"#\", \"input\", \"filter\", \"output\" at line 13, column 3 (byte 168)
after ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'",
"org/logstash/execution/AbstractPipelineExt.java:187:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'",
"/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in
`execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:383:in `block in converge_state'"]}
[2022-10-04T16:20:27,868][INFO][org.reflections.Reflections] Reflections took 107 ms to scan 1 urls, producing 119 keys and 417 values
[2022-10-04T16:20:28,837][WARN][deprecation.logstash.codecs.plain] Relying on default value of `pipeline.ecs_compatibility`, which may change in a future major release
```
this my file
```auto
input {
file {
path => ["/logstash_dir/P1/*.*"]
start_position => "beginning"
}
}
#Grokking Spring Boot's default log format
grok {
match => [ "message",
"(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}) %{LOGLEVEL:level} %{NUMBER:pid} --- \[(?[A-Za-z0-9-]+)\] [A-Za-z0-9.]*\.(?[A-Za-z0-9#_]+)\s*:\s+(?.*)",
"message",
"(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}) %{LOGLEVEL:level} %{NUMBER:pid} --- .+? :\s+(?.*)"
]
}
date {
match => ["message", "yyyy-MM-dd HH:mm:ss,SSS"]
# target => "@timestamp"
# timezone => "Europe/Berlin"
}
output {
if " ERROR " in [message] {
elasticsearch {
hosts => ["elasticsearch:9200"]
index => "error_p1"
}
} else {
elasticsearch {
hosts => ["elasticsearch:9200"]
index => "others_p1"
}
}
stdout { codec => rubydebug }
}
```
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [October 4, 2022, 6:04pm UTC](https://discuss.elastic.co/t/extract-originals-timestamp-from-logs/315798/5 "2022-10-04T18:04:59Z")
You have missed "filter" and date needs the "timestamp" field. I left "message" because I used it in generator just for test. Disclaimer: I haven't test grok pattern.
```auto
input {
file {
path => ["/logstash_dir/P1/*.*"]
start_position => "beginning"
}
}
filter{
#Grokking Spring Boot's default log format
grok {
match => [ "message",
"(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}) %{LOGLEVEL:level} %{NUMBER:pid} --- \[(?[A-Za-z0-9-]+)\] [A-Za-z0-9.]*\.(?[A-Za-z0-9#_]+)\s*:\s+(?.*)",
"message",
"(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}) %{LOGLEVEL:level} %{NUMBER:pid} --- .+? :\s+(?.*)"
]
}
date {
match => ["message", "yyyy-MM-dd HH:mm:ss,SSS"]
# target => "@timestamp"
# timezone => "Europe/Berlin"
}
}
output {
if " ERROR " in [message] {
elasticsearch {
hosts => ["elasticsearch:9200"]
index => "error_p1"
}
} else {
elasticsearch {
hosts => ["elasticsearch:9200"]
index => "others_p1"
}
}
stdout { codec => rubydebug }
}
```
---
### Author:  [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)
#### Post date: [October 4, 2022, 6:58pm UTC](https://discuss.elastic.co/t/extract-originals-timestamp-from-logs/315798/6 "2022-10-04T18:58:21Z")
hello i've changed config but have errore
```
[0] "_grokparsefailure",
```
```auto
"@version" => "1",
"message" => "2022-09-22 14:26:09,326 INFO [org.apache.camel.component.mllp.MllpTcpServerConsumer.9010] (TcpServerConsumerValidationRunnable[mllp://0.0.0.0:9010] - /192.168.0.7:54650 => /192.168.0.32:9010) startConsumer(Socket[addr=/192.168.0.7,port=54650,localport=9010]) - starting consumer",
"@timestamp" => 2022-10-04T18:56:30.641Z,
"host" => "5584e91225ff",
"tags" => [
[0] "_grokparsefailure",
[1] "_dateparsefailure"
],
"path" => "/logstash_dir/P1/server.log.2022-09-22"
filter{
#Grokking Spring Boot's default log format
grok {
match => [ "message",
"(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}) %{LOGLEVEL:level} %{NUMBER:pid} --- \[(?[A-Za-z0-9-]+)\] [A-Za-z0-9.]*\.(?[A-Za-z0-9#_]+)\s*:\s+(?.*)",
"message",
"(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}) %{LOGLEVEL:level} %{NUMBER:pid} --- .+? :\s+(?.*)"
]
}
date {
match => ["message", "yyyy-MM-dd HH:mm:ss,SSS"]
# target => "@timestamp"
# timezone => "Europe/Berlin"
}
}
```
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [October 5, 2022, 3:06am UTC](https://discuss.elastic.co/t/extract-originals-timestamp-from-logs/315798/7 "2022-10-05T03:06:35Z")
> [@Nikolas1306](#):
>
> ```auto
> 2022-09-25 21:19:57,175 INFO [it.unidoc.cdr.core.bean.ForwardProvideAndRegisterManager] (Camel (camel-1) thread #153 - WireTap) Evaluate 2 item in OR...
>
> ```
That first timestamp is a common format use this... then LOGLEVEL then I think it is a JAVACLASS... you can work it from there, I am not a regex expert..
```auto
2022-09-25 21:19:57,175 INFO [it.unidoc.cdr.core.bean.ForwardProvideAndRegisterManager] (Camel (camel-1) thread #153 - WireTap) Evaluate 2 item in OR...
%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} \[%{JAVACLASS:class}\] %{GREEDYDATA:log_details}
{
"log_details": "(Camel (camel-1) thread #153 - WireTap) Evaluate 2 item in OR...",
"level": "INFO",
"class": "it.unidoc.cdr.core.bean.ForwardProvideAndRegisterManager",
"timestamp": "2022-09-25 21:19:57,175"
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 2, 2022, 3:07am UTC](https://discuss.elastic.co/t/extract-originals-timestamp-from-logs/315798/8 "2022-11-02T03:07:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.