If I have a line like:
the quick brown fox
How can I grok "brown" out of that line?
(?<color>(brown)) Does not work.
If I do something like
(?<color>.*(brown)), the color field ends up with "the quick brown".
My specific use case is getting the timestamp from the GitLab production.log file. It is not at the beginning of the line.
I've been testing with Grok Constructor but I just haven't figured it out. And at this time of day, I'm not going to get any farther. So any help will be appreciated.