How to read microseconds in grok like hh:mm:ss.SSSSSS

Elastic Stack Logstash
1

Hi I need help on how to read microseconds from my log. Seconds format ss.SSS is working fine but not ss.SSSSSS. Is there anyway read value? When verify %{TIME:logtime} its working fine in online grok debugger but failed to parse my test. Parser error is related to last 3 digits( microseconds). Please anyone help me on this. Thanks

2

If it's the date filter you're talking about I think it only supports millisecond precision. You have use the mutate filter's gsub option to chop off the last three digits that the grok filter captured before you feed the string to the date filter.

1 Like
3

Thanks for your reply. I have followed as per your suggestion and its resolved now:

      mutate {
              gsub => ["timestamp","\d\d\d$",""]
      }
2 Likes