Issues with DATESTAMP pattern

Elastic Stack Logstash
1

I am trying to parse the date which has YYYY/MM/DD HH:MM:SS format. For this I am using DATESTAMP pattern. If I just take the date from log 2018/09/26 17:00:04 and use %{DATESTAMP:test} then it gives proper output in grok debugger (inside kibana).

{
"test": "18/09/26 17:00:04"
}

But if the date is surrounded by commas(,) then it gives error. So if it is like this ,2018/09/26 17:00:04,and I use this pattern \,%{DATESTAMP:test}\, or even ,%{DATESTAMP:test}, results in error.

Is there some bug or am I doing something wrong?

2

I am trying to parse the date which has YYYY/MM/DD HH:MM:SS format. For this I am using DATESTAMP pattern.

DATESTAMP is for mm/dd/yyyy and dd/mm/yyyy dates. See its definition:

Try this: (?<timestamp>%{YEAR}/%{MONTHNUM}/%{MONTHDAY} %{TIME})

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.