Log file without Year

Elastic Stack Logstash
1

Hi guys, I have logs in format:
Mar 23 11:54:35 server [Controller] [Thread-530] ERROR Connection error

I tried to use next filter, but it doesn't work,

filter {
if [type] == "data" {

grok {
  match => {
    "message" => [
      "^%{TIMESTAMP_ISO8601:timestamp} %{GREEDYDATA}$"
    ]
  }
}

date {
  match => [ "timestamp", "MMM dd HH:mm:ss"  ]
}

}
}

Any one had similar issues?

Thanks

2

The TIMESTAMP_ISO8601 pattern is for ISO8601 dates but your date is in another format. Since your log appears to be from syslog, why not use a syslog pattern?

https://www.elastic.co/guide/en/logstash/current/config-examples.html#_processing_syslog_messages

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.