Grok pattern for date

(talia) #1

I have a log file that I want to parse to elasticsearch using logstash.
In the log I have a date like that:
I trying to find how to grok this timestamp with kibana Grok Debugger
Trying the following pattern but with no success:
Any suggestion?



The closest pattern I could find that is known by Logstash is this


The + between the date and time doesn't seem to be in any so you will have to make your own.

This pattern should work

(talia) #3

Just to be sure, for combinning all the feilds that I get from this pattern I have to use the mutate in the logstash file?
like this:

mutate {
add_field => {
"timestamps" => "%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:?%{MINUTE}(?::?%{SECOND}) %{ISO8601_TIMEZONE}"


That was a grok pattern. You can put it in a pattern file or specify it inside the grok filter like

grok {
  match => { "filed_name" => "YOUR FULL LINE GROK PATTERN GOES HERE. YOU CAN USE %{MY_TIME:timestamp} FOR THE DATE PART"
  pattern_definitions => {

Not entirely sure what the best way to turn the time into @timestamp would be...

(talia) #5

Thanks a lot


This shows the pattern you need to parse it.