Hi!
I tried your second solution but apparently it doesn't make a field out of it. Is there something I have missed?
filter {
grok {
type => "nexus-log"
break_on_match => false
match => [
"message", "\b\w+\b\s/nexus/content/repositories/(?<repositories>[^/]+)",
"message", "(?<mytimestamp>%{MONTHDAY}/%{MONTH}/%{YEAR}:%{HOUR}:%{MINUTE}:%{SECOND} %{ISO8601_TIMEZONE})",
"message", "(%{WORD:requesttype reps}) /nexus/content/repositories/",
"message", "(%{WORD:requesttype groups}) /nexus/content/groups/public/com/jeppesen/jcms/",
"message", "\b\w+\b\s/nexus/content/repositories/jts-development/(?<repofile>.*\.pom)$",
"message", "\b\w+\b\s/nexus/content/groups/public/com/jeppesen/jcms/(?<groups>[^/]+)"
]
}
date{
match => ["mytimestamp", "dd/MMM/YYYY:HH:mm:ss Z" ]
remove_field => ["mytimestamp"]
}
}