Log file without Year

Hi guys, I have logs in format:
Mar 23 11:54:35 server [Controller] [Thread-530] ERROR Connection error

I tried to use next filter, but it doesn't work,

filter {
if [type] == "data" {

grok {
  match => {
    "message" => [
      "^%{TIMESTAMP_ISO8601:timestamp} %{GREEDYDATA}$"

date {
  match => [ "timestamp", "MMM dd HH:mm:ss"  ]


Any one had similar issues?


The TIMESTAMP_ISO8601 pattern is for ISO8601 dates but your date is in another format. Since your log appears to be from syslog, why not use a syslog pattern?


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.