Grok filter date format

Elastic Stack Logstash
1

Hello.

I have a date with the blow format in my log files (Nginx error log).

2016/11/15

I am trying to create a Grok filter for it. However, I can't seem to find any date stamp for it. I tried all of Grok's date stamps the only one that matches is DATESTAMP but it doesn't put the dates in the correct fields. the month is in the year and so on.

I used this for the Grok filter:

%{YEAR:year}\/%{NUMBER:month}\/%{NUMBER:day}

Using the Grok debugger I checked that this works fine but how does that work in terms of Logstash as it parses the day and month as number rather than dates.

Any help is very much appreciated.

2

Found it. Was looking for a whole day and just searching a related topic I stumbled on a comment that had what I needed its this patter:

(?<timestamp>%{YEAR}[./]%{MONTHNUM}[./]%{MONTHDAY} %{TIME})

its for the date and the time stamp. Works like a charm. Just hope it works well with Elasticsearch.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.