Grok parse failure and date format error

(Korhan Herguner) #1

I want to parse to below line but grok pattern get error. How can ı parse below line?

12/May/19 20:03:14


What grok pattern are you using? What error do you get?

(Korhan Herguner) #3

I am using grok pattern %{HTTPDATE:time_local} but not parsing
Actually ı need below model but ı don't know how ı can
time_local:12/MAY/2019 20:03:14,
ı need grok pattern for above json model


If your data looks like

12/May/19 20:03:14

i.e. three space-separated fields, then I wouldn't use grok at all. I would dissect it

dissect { mapping => { "message" => "%{time_local} %{+time_local} %{ip}" } }