Grok Filter not being applied

vspp_manager1_log 09/08/17 19:12:55.874 I SESSION 17126 @EGPHCAAAHLLOCLJF Session allocation request: streamer_id, initiator /, stb_id , s_mode STATIC, device profile

if [message] =~ "vspp_manager1_log" {
grok {
match => ["message", '%{NOTSPACE:role} %{DATE_US:timestamp_match} %{TIME:timematch} %{GREEDYDATA:message}']
overwrite => ["message"] }
date {
match => [ "timematch", "HH:mm:ss.SSS"]
target=> "@timestamp"
remove_field => ["timematch"]}}

The role and timestamp are not being created. Any ideas?

Please show an example event that Logstash has processed. Use a stdout { codec => rubydebug } output.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.