Grock for [10/26/23 10:48:30:823 CEST] date format for Logstash filter

Elastic Stack Elasticsearch
1

Hello.
I'm looking for grock filter matching this format [10/26/23 10:48:30:823 CEST]
can't find any match from predefined formats. I need it to my Logstash filter. Any ideas ?

2

Hi @elk1985

You don't say what fields you want out of it, this might get you where you want to go:

\[%{DATE_US:date} %{TIME:time} %{WORD:timezone}\]

A few general pointers when using grok with elastic:

  1. Elastic Grok documentation
  2. Logstash grok patterns (always gives me good ideas and helps me not reinvent the wheel).
  3. Grok debugger in kibana will help you experiment and see what works.

Good luck