Grok TIMESTAMP_ISO8601 doesnot capture TZ


(Santosh Hulkund) #1

How can i parse TZ using grok

2018-03-05 21:29:31 -0500,188c3263-2519-4a8d-825c-4605c53b720e

TIMESTAMP_ISO8601 does not capture -0500

Grok Debugger ...

{
  "TIMESTAMP_ISO8601": [
    [
      "2018-03-05 21:29:31"
    ]
  ],
  "YEAR": [
    [
      "2018"
    ]
  ],
  "MONTHNUM": [
    [
      "03"
    ]
  ],
  "MONTHDAY": [
    [
      "05"
    ]
  ],
  "HOUR": [
    [
      "21",
      null
    ]
  ],
  "MINUTE": [
    [
      "29",
      null
    ]
  ],
  "SECOND": [
    [
      "31"
    ]
  ],
  "ISO8601_TIMEZONE": [
    [
      null
    ]
  ]
}

(Santosh Hulkund) #2

Is this efficient way to match ?

(?<timestamp>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} [+-]*\d{4})\,%{UUID:session_id}


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.