I am facing issues while parsing date using grok plugin in Filter

I have the below in my logs
"2019-07-09\t07:35:42.210\t0.193\t0\tGET\t{URI}\t304\t{ECID}\t{someId}\t-\t{ip address}

I am not able to figure out how should i frame my filter using GROK.

I tried with something like the below:

filter {
grok{
match=>{"message" => "%{YEAR}-%{MONTHNUM}-%{MONTHDAY}\t%{HOUR}:%{MINUTE}:%{SECOND}(.[0-9])%{GREEDYDATA:message}"}
}
}

Please let me know what i am doing wrong, getting erroo 'grokParseFailure'.
I am new to Logstash.

Your help will be highly appreciated.

Thanks
Subrat.

If your message is tab separated the use \s in the grok pattern to match it, not \t.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.