JeremyP
December 10, 2021, 9:08pm
1
Hi.... I'm looking for some help on creating a new field based on a grok pattern.
Here is the field in question:
"last_assessed_for_vulnerabilities": "2021-12-10T07:05:41.154Z"
I'm looking to create the following field using the year and month date...
report_period : 2021-12
I'm close, but I can't seem to get GROK to process the month properly. Any help is appreciated!
Badger
December 10, 2021, 10:01pm
2
How about
grok {
pattern_definition => { "MYDATE" => "%{YEAR}-%{MONTHNUM}" }
match => { "last_assessed_for_vulnerabilities" => "^%{MYDATE:someFeild}" }
}
system
(system)
Closed
January 7, 2022, 10:02pm
3
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.