Grok format for [10-May-2017 16:16:33] - || Response = 400

Elastic Stack Elasticsearch
1

I want to use this pattern in logstash but unable to find pattern for [10-May-2017 16:16:33] timestamp

Kingly help me if anyone knew it.

2

The following should work:

"\[%{MONTHDAY:day}-%{MONTH:month}-%{YEAR:year} %{TIME:time}\]"

Please direct future question to the #logstash topic.

3

Thanks a lot @ jakelandis it works . But I need a single variable timestamp which should contain all date and time sothat I can use that in visualization in kibana.

4

In that case you will want something like the following :

  grok {
     match => {
       message => "\[%{DATA:ts}\]"
     }
   }
  date {
    match => [ "ts", "dd-MMM-yyyy HH:mm:ss"]
    remove_field => [ "ts" ]
  }

Please direct future Logstash question to the #logstash topic.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.