Grok pattern match but replace a character from result

Hi all
I am trying to extract the timestamp from a log file but the date and time are separated by a semicolon. Is there a way I can make my Grok pattern work but replace the semicolon with a space ?

Here is a sample from the log -
2019-11-18;05:10:55.954;INFORMATION;domain;test.user;2;1120;CheckUserExistsInGroup: No Entries Found In ExcludedGroups

this is my Grok pattern -
%{TS_CUST:timestamp:ts-"2006-01-02 15:04:05.999"};%{WORD:Status:tag};%{WORD:Domain:tag};%{USERNAME:username:tag};%{NUMBER:SessionID:int};%{NUMBER:ProcessID:int};%{WORD:Action}: %{GREEDYDATA:message}

and from grok debugger here is the output -

"timestamp": [
"Status": [
"Domain": [
"username": [
"Action": [
"message": [
"No Entries Found In ExcludedGroups"

I have been trying for ages to get rid of the semicolon between the date and time and replace with a 'space' in the 'timestamp' match as influxDB won't accept the timestamp with the semicolon. It seems that the semicolon is not being 'escaped' in my pattern. Any help would be greatly appreciated

You could use mutate+gsub to replace the semicolon with a space.

Thanks Badger - I may have posted in the wrong place but I am using a Telegraf logparser plugin using Grok inputs and I don't think I can use mutate-gsub

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.