Filter with spaces and extra pattern

Elastic Stack Logstash
1

Hi guys,

I have another parsing question :slight_smile:
My filebeat and logstash are working fine except for a problem in parsing a time in the format HH.MM.SS instead of the double point.

My message currently looks like this:
22.01.2020 ! 08.35.34 ! 92 ! MY TEXT ! 122#!

My filter looks like this:
match => {"message" => "%{DATE_EU:date}\s*!\s*%{TIME:time}\s*!\s*%{INT:number}\s*!\s*%{DATA:text}\s*!\s*%{INT:occurence}#!"}

My "extra.grok" definition of TIME:
TIME %{BASE10NUM}.%{BASE10NUM}.%{BASE10NUM}

But somehow, the field "time", "number" and "text" are not filled correctly in Kibana due to the "time" being with points...

Can you advise how to solve it? What am I missing? It takes for "time" only the first 2 digits until the point and therefore the output shifts for these values :frowning:

2

Try

pattern_definitions => { "TIME" => "%{INT}\.%{INT}\.%{INT}" }
3

You're a genius, that's what did the trick :slight_smile:
Thank you so much!!
It didn't work when I added it to my extra.grok pattern file which I link within the logstash but it worked directly in the logstash file :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.