I am facing issues while parsing date using grok plugin in Filter

Elastic Stack Logstash
1

I have the below in my logs
"2019-07-09\t07:35:42.210\t0.193\t0\tGET\t{URI}\t304\t{ECID}\t{someId}\t-\t{ip address}

I am not able to figure out how should i frame my filter using GROK.

I tried with something like the below:

filter {
grok{
match=>{"message" => "%{YEAR}-%{MONTHNUM}-%{MONTHDAY}\t%{HOUR}:%{MINUTE}:%{SECOND}(.[0-9])%{GREEDYDATA:message}"}
}
}

Please let me know what i am doing wrong, getting erroo 'grokParseFailure'.
I am new to Logstash.

Your help will be highly appreciated.

Thanks
Subrat.

2

If your message is tab separated the use \s in the grok pattern to match it, not \t.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.