Grok timestamp


(Maher Glenza) #1

20170118154716225
plz what is its format in grok ?


(Maher Glenza) #2

to notice i want it to be a date
YYYYMMDDHHmmssSSS


(Magnus Bäck) #3

For example (?<timestamp>%{YEAR}%{MONTHNUM}%{MONTHDAY}%{HOUR}%{MINUTE}%{SECOND}\d+).

Of course, this string also happens to be an integer so unless you want validation that the input string really is a YYYYMMDDHHmmssSSS timestamp you can just do %{INT:timestamp}.


(Maher Glenza) #4

hi magnus
i think you didn t understand me
i want the input to be YYYYMMDDHHmmssSSS (for example 20170118154716225)
and i want the grok to consider it as date


(Magnus Bäck) #5

You have a log where each line contains a timestamp like e.g. 20170118154716225, yes? Then the grok expression samples I gave will extract that into a field named timestamp that you can feed to the date filter.


(Maher Glenza) #6

okay thank you magnus !!!


(Maher Glenza) #7

just one thing magnus plz
where i put
(?%{YEAR}%{MONTHNUM}%{MONTHDAY}%{HOUR}%{MINUTE}%{SECOND}\d+). ?


(Magnus Bäck) #8

In your grok expression in your grok filter. The (?<fieldname>...) syntax I used is described in the grok filter documentation.


(Maher Glenza) #9

sory i didn t understand this is my grok
grok {
match => ["message","%{TIMESTAMP_ISO8601:datePvin} : %{UUID:id} %{INT:daterecepPvin} %{NUMBER:datefintraitPvin} %{NUMBER:delai} %{WORD:nomFlux} %{GREEDYDATA:evts} %{WORD:BU} %{NUMBER:reforigin} %{NOTSPACE:contractoidval} %{DATA:useroidval} %{DATA:errorStatus} %{GREEDYDATA:errorDesc} %{NOTSPACE:servname}"] }

and i want to do this treatment on %{INT:daterecepPvin} how the grok will become ?


(Magnus Bäck) #10

So you're already capturing the timestamp into the daterecepPvin field? What more do you want to achieve?


(Maher Glenza) #11

i don t want it to be INT but a DATE


(Magnus Bäck) #12

The grok filter doesn't create dates. It creates strings, integers, and floats. If you the timestamp you have to become a date in ES you need to adjust your mappings or use the date filter to convert it into a string that ES will recognize as a date out of the box.


(Maher Glenza) #13

i didn t recognize how to use the date filter i tried this grok {

		match => ["message","%{TIMESTAMP_ISO8601:datePvin} : %{UUID:id} %{timeStamp:daterecepPvin} %{NUMBER:datefintraitPvin} %{NUMBER:delai} %{WORD:nomFlux} %{GREEDYDATA:evts} %{WORD:BU} %{NUMBER:reforigin} %{NOTSPACE:contractoidval} %{DATA:useroidval} %{DATA:errorStatus} %{GREEDYDATA:errorDesc} %{NOTSPACE:servname}"]

}
date {

match => [ "daterecepPvin" , "YYYYMMDDHHmmssSSS" ]

}

}

but it didn t work


(Magnus Bäck) #14

Check the Logstash log. If the date filter fails it'll give you clues.


(Maher Glenza) #15

ok thanks


(system) #16

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.