Grok multiple date formats

Elastic Stack Logstash
1

I'm trying to parse syslog messages from 2 sources at the moment, but they have different date formats:

 <12>Jul 16 14:37:33
 <30>2019:07:16-14:23:13

Right now I got the following:

<%{POSINT:syslog_pri}>%{YEAR}:%{MONTHNUM}:%{MONTHDAY}-%{HOUR}:?%{MINUTE}(?::?%{SECOND}) %{SYSLOGHOST:syslog_host} %{DATA:syslog_program}\[%{NUMBER:syslog_pid}\]\: %{GREEDYDATA:syslog_message}

<%{POSINT:syslog_pri}>%{MONTH} %{MONTHDAY} %{TIME} %{SYSLOGHOST:syslog_host} %{DATA:syslog_program}\[%{NUMBER:syslog_pid}\]\: %{GREEDYDATA:syslog_message}

Both these parse one of the formats.

I'm having a hard time to create the correct config so both of these formats are processed correctly.
How can I combine these?

2

You should be able to do alternation using |

<%{POSINT:syslog_pri}>(%{YEAR}:%{MONTHNUM}:%{MONTHDAY}-%{HOUR}:?%{MINUTE}(?::?%{SECOND})|%{MONTH} %{MONTHDAY} %{TIME}) %{SYSLOGHOST:syslog_host} %{DATA:syslog_program}\[%{NUMBER:syslog_pid}\]\: %{GREEDYDATA:syslog_message}
3

Perfect! That does the trick.

Thank you!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.