Logstash Dissect Filter - Multiple Delimiters?

Elastic Stack Logstash
1

Hi all, what is the the best way to support multiple delimiters with the Logstash Dissect Filter?

As an example, suppose one file has logs set up as follows:
2018-11-06_05:30:21 Log message1
And another file has logs set up as such:
2018-11-06-05:30:21 Log message 2
Note the different delimiter between the date and time.

I want to use the same filter for both log files. What is the preferred way to handle this?
I haven't had any luck with the following Logstash filter:

filter {
   dissect { 
      mapping => { 
         "message" => "%{year}-%{month}-%{day}{_,-}%{hour}:%{min}:%{sec} %{msg}"
      }
   }
}

The {_,-} (a common glob pattern) breaks my parsing. Is there any support for this? Or would I just be better off with two separate filters?

Thanks in advance!

Matt

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.