Logstash Conf for Mainframe Logs

(Sajeew Ganesh) #1

Hi All,

I have a mainframes systems log, How do we grok for the julian date?
The sample log is mentioned below.

X 0000000 T158 2017208 23:59:00.27 SYSLOG 00000000 IEE042I SYSTEM LOG DATA SET INITIALIZED

(Mark Walkom) #2

What have you tried?

(Sajeew Ganesh) #3

i used the below for the time,


The below grok is not the complete one.

grok {
match => [ "message", "\A%{TIMESTAMP_ISO8601:date: }" ]
overwrite => [ "message" ]
date {
match => [ "Date","yyyyddd HH:mm:ss,SSS"]
target => "Date"

(Sajeew Ganesh) #4

Is there a method to convert the julian date format to a normal user readable one. Or will it be done by logstash itself?

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.