How to read microseconds in grok like hh:mm:ss.SSSSSS

Hi I need help on how to read microseconds from my log. Seconds format ss.SSS is working fine but not ss.SSSSSS. Is there anyway read value? When verify %{TIME:logtime} its working fine in online grok debugger but failed to parse my test. Parser error is related to last 3 digits( microseconds). Please anyone help me on this. Thanks

If it's the date filter you're talking about I think it only supports millisecond precision. You have use the mutate filter's gsub option to chop off the last three digits that the grok filter captured before you feed the string to the date filter.

1 Like

Thanks for your reply. I have followed as per your suggestion and its resolved now:

      mutate {
              gsub => ["timestamp","\d\d\d$",""]
      }
2 Likes