Grok pattern problem

[mmk1995 (MatthewMak)]

Hi all,

I am facing a log pattern like this

xxxxx.com on 2017-5-15 16:38:18 from 142.xx.xx.xx

And I tried to use grok like this:

grok {
match => { "message" => [
"Timestamp: %{DATESTAMP:timestamp}",
"IP: %{IP:ip}",
"URI: %{URI:uri}"
]
}
or
"%{URI:uri} on %{DATESTAMP:timestamp} from %{IP:ip}"

Why both are not working? Thank you in advance.

[Badger]

DATESTAMP is not designed to consume YYYY-MM-dd, so it matches 17-5-15. This will match

"^%{URI:uri} on 20%{DATESTAMP:timestamp} from %{IP:ip}"

I would expect this to work, but it only matches the first pattern in the array. I am unable to understand that.

    grok {
        match => {
            break_on_match => false
            "message" => [
                "%{URI:uri}",
                "%{IP:ip}",
                "%{DATESTAMP:timestamp}"
            ]
        }
    }