Grok format for [10-May-2017 16:16:33] - || Response = 400


(Satyaban Dalabehera) #1

I want to use this pattern in logstash but unable to find pattern for [10-May-2017 16:16:33] timestamp

Kingly help me if anyone knew it.


(Jake Landis) #2

The following should work:

"\[%{MONTHDAY:day}-%{MONTH:month}-%{YEAR:year} %{TIME:time}\]"

Please direct future question to the #logstash topic.


(Satyaban Dalabehera) #3

Thanks a lot @ jakelandis it works . But I need a single variable timestamp which should contain all date and time sothat I can use that in visualization in kibana.


(Jake Landis) #4

In that case you will want something like the following :

  grok {
     match => {
       message => "\[%{DATA:ts}\]"
     }
   }
  date {
    match => [ "ts", "dd-MMM-yyyy HH:mm:ss"]
    remove_field => [ "ts" ]
  } 

Please direct future Logstash question to the #logstash topic.


(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.