How to search log line for a specific pattern format

Use grok. grok patterns are not anchored, so they will find the date and time anywhere in the line

    grok {
        break_on_match => false
        match => { "message" => [ "\b(?<date>\d{2}/\d{2}/\d{4})\b", "\b(?<time>\d{2}:\d{2}:\d{2})\b" ] }
    }
1 Like