Grok pattern construction

Elastic Stack Logstash
1

Hi, I need help constructing the grok pattern for the following log messages

Fri Mar 18 17:43:27 2022 : Info: Debugger not attached
Fri Mar 18 17:43:27 2022 : Info: Loaded virtual server inner-tunnel
Fri Mar 18 17:43:27 2022 : Info: Loaded virtual server <default>

TIMESTAMP_ISO8601 does not seem to match the format.
new to elk, help would be appreciated

Thank you!

2

Hi,

The date you have don't fit TIMESTAMP_ISO8601 pattern.
I think it fit this one.

So the grok filter should look like this :
%{HTTPDERROR_DATE:date}\s:\s%{LOGLEVEL:log}:%{GREEDYDATA:comment}

Cad.

3

It works, Thank you so much!

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.