Grok filter (2018-02-01T09:33:02.000000+01:00)

I need a filter to this message..

<6>1 2018-02-01T09:33:02.000000+01:00 MSA1040_CPD1 APPSV 2238 - [details@347 ust="116444772000000000" lst="116444736000000000" ip="" ssn="B9999" eventPriority="Informational" eventType="312"] Test event from system name MSA1040_CPD1, type HP MSA 1040 SAN, S/N 2S6418B133, part number 717869-001

is it possible ??

Have you looked at the grok constructor web site?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.