# Grok GUnicorn error log date format?

**URL:** <https://discuss.elastic.co/t/grok-gunicorn-error-log-date-format/178290>\
**Category:** Logstash\
**Created:** [April 24, 2019, 3:31pm UTC](https://discuss.elastic.co/t/grok-gunicorn-error-log-date-format/178290 "2019-04-24T15:31:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![JJB](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jjb/32/44079_2.png) [@JJB](https://discuss.elastic.co/u/JJB)\
**Post date:** [April 24, 2019, 3:31pm UTC](https://discuss.elastic.co/t/grok-gunicorn-error-log-date-format/178290/1 "2019-04-24T15:31:39Z")

</div>

[GUnicorn](http://docs.gunicorn.org/en/stable/settings.html#errorlog) uses this format for the error log file:

```
[2019-04-24 14:53:51 +0000] [10] [INFO] Starting gunicorn 19.4.5
[2019-04-24 14:53:51 +0000] [10] [INFO] Listening at: http://0.0.0.0:12007 (10)

```

Is the timestamp a standard ISO format that can be used in grok?

Currently my logstash pipeline grok filter looks like this, and it works but I'm not sure if this is the right way to do it. I'm parsing `thetime` out as just `DATA` and then using `date` plugin:

```
  else if "gunicorn" in [tags] {
    grok {
      match => ["message", "(?m)\[%{DATA:thetime}\] \[%{DATA:pid}\] \[%{LOGLEVEL:level}\] %{GREEDYDATA:event}" ]
    }
    date {
      locale => "en"
      match => ["thetime", "YYYY-MM-dd HH:mm:ss Z"]
      timezone => "UTC"
    }
  }

```

If this is ok then I'll leave it as-is, but it would be good to know what others would do.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 24, 2019, 3:45pm UTC](https://discuss.elastic.co/t/grok-gunicorn-error-log-date-format/178290/2 "2019-04-24T15:45:58Z")

</div>

If it works it is OK. That said, personally I would use a dissect filter for a delimited format like that

```
dissect { mapping => { "message" => "[%{thetime}] [%{pid}] [%{level}] %{event}" } }
```

---

<div class="post-metadata">

**Author:** ![JJB](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jjb/32/44079_2.png) [@JJB](https://discuss.elastic.co/u/JJB)\
**Post date:** [April 25, 2019, 8:20am UTC](https://discuss.elastic.co/t/grok-gunicorn-error-log-date-format/178290/3 "2019-04-25T08:20:15Z")

</div>

Thanks. Would that work for multiline too? I'm using filebeat to package up the events as multiline like this:

```
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /usr/share/logs/microservices/**/error_log
  multiline.pattern: '^\[(\S+) (\S+) (\S+)\] \[(\S+)\] \[(\S+)\] '
  multiline.negate: true
  multiline.match: after
  tags: ["gunicorn"]
```

---

<div class="post-metadata">

**Author:** ![JJB](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jjb/32/44079_2.png) [@JJB](https://discuss.elastic.co/u/JJB)\
**Post date:** [April 25, 2019, 12:05pm UTC](https://discuss.elastic.co/t/grok-gunicorn-error-log-date-format/178290/4 "2019-04-25T12:05:42Z")

</div>

Don't worry, I can confirm the dissect syntax above works for multiline.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 23, 2019, 12:05pm UTC](https://discuss.elastic.co/t/grok-gunicorn-error-log-date-format/178290/5 "2019-05-23T12:05:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.