Grok format for [10-May-2017 16:16:33] - || Response = 400

[satyaban (Satyaban Dalabehera)]

I want to use this pattern in logstash but unable to find pattern for [10-May-2017 16:16:33] timestamp

Kingly help me if anyone knew it.

[jakelandis]

The following should work:

"\[%{MONTHDAY:day}-%{MONTH:month}-%{YEAR:year} %{TIME:time}\]"

Please direct future question to the #logstash topic.

[satyaban (Satyaban Dalabehera)]

Thanks a lot @ jakelandis it works . But I need a single variable timestamp which should contain all date and time sothat I can use that in visualization in kibana.

[jakelandis]

In that case you will want something like the following :

  grok {
     match => {
       message => "\[%{DATA:ts}\]"
     }
   }
  date {
    match => [ "ts", "dd-MMM-yyyy HH:mm:ss"]
    remove_field => [ "ts" ]
  } 

Please direct future Logstash question to the #logstash topic.