Grok pattern for the time which has some character attached to it

[Harish_Kumar2 (Harish Kumar)]

i have log beginning with time and time format is like

09:16:07.080_M_I_ [10:06] SO(000000000463f2a8 1629 2)

i tried grok pattern
grok {

match => {"message" => "%{WORD:Timestamp}%{SPACE}%{GREEDYDATA:Logmessage}"}
		}
		}

which did not work, i also tried matching the timestamp with matchings like HH:MM:SS.xxx_Z_Z_Z?

can any one help me on this?

[ITIC (Jordi)]

Hi

You could try this (or some variation of it):

match => {"message" => "%{GREEDYDATA:Timestamp}_%{GREEDYDATA:dummy}%{SPACE}%{GREEDYDATA:Logmessage}"}

Hope this helps.

[Harish_Kumar2 (Harish Kumar)]

Hi Thank you, I got the solution by tweaking bit more: %{TIME:EventTime}_%{NOTSPACE}%{SPACE}%{NOTSPACE:HexEvent}%{GREEDYDATA:Message}