How should I filter this date?

My logs are TSVs that look like the following:

|2021-08-11T13-55-39.207|1628682939207|STEP|TIC|4548715304|11172954112||I login as 'admin'|

But there's a T in my Date and I when I try to add that date format it is not correctly recognized by Elastic.

filter {
  grok {
    match => ["message", "%{DATA:timestamp} .*"]
  date {
    match => ["timestamp", "HH:MM:ss.SSSZZZ"]

The pattern has to match every single character in the field it is trying to parse.

The grok makes no sense to me. It is not going to find a space to terminate the [timestamp] field until it gets to I login as 'admin'.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.