Filter date in logstash

I am traying to filter a format date like below message log with grok, but not luck

01-NOV-2019 00:09:01 * (ADDRESS=(PROTOCOL=tcp)(HOST=10.10.84.62) 
(PORT=48482)) * <unknown connect data> * 12537

From debugger works but at the moment to restart logstash is just not showing the new fields filtered expected, like :

%{NOTSPACE} %{TIME}

Output:

{
  "NOTSPACE": [
[
  "01-NOV-2019"
]
  ],
  "TIME": [
[
  "00:09:22"
]
  ]
}

Any other better idea or advise ?

Thanks & Regards,
Jorge

Filter configuration in logstash is

filter {
        grok {
   match => {"message" => [ "%{NOTSPACE} %{TIME})" ]}
  }
}

Remove the ) that comes after %{TIME}

Thanks for the observation, modifying the same even did not work

here an example how is being indexed, seems there is a grok failure, but in logstash output is not reporting any error message, the message showing is the same which is tested on grok debugger to get the date without issues ...

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.