Grok pattern for the time which has some character attached to it

i have log beginning with time and time format is like :slight_smile:

09:16:07.080_M_I_ [10:06] SO(000000000463f2a8 1629 2)

i tried grok pattern
grok {

match => {"message" => "%{WORD:Timestamp}%{SPACE}%{GREEDYDATA:Logmessage}"}

which did not work, i also tried matching the timestamp with matchings like HH:MM:SS.xxx_Z_Z_Z?

can any one help me on this?


You could try this (or some variation of it):

match => {"message" => "%{GREEDYDATA:Timestamp}_%{GREEDYDATA:dummy}%{SPACE}%{GREEDYDATA:Logmessage}"}

Hope this helps.

Hi Thank you, I got the solution by tweaking bit more: %{TIME:EventTime}_%{NOTSPACE}%{SPACE}%{NOTSPACE:HexEvent}%{GREEDYDATA:Message}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.