Logstash Dissect Filter - Multiple Delimiters?

Hi all, what is the the best way to support multiple delimiters with the Logstash Dissect Filter?

As an example, suppose one file has logs set up as follows:
2018-11-06_05:30:21 Log message1
And another file has logs set up as such:
2018-11-06-05:30:21 Log message 2
Note the different delimiter between the date and time.

I want to use the same filter for both log files. What is the preferred way to handle this?
I haven't had any luck with the following Logstash filter:

filter {
   dissect { 
      mapping => { 
         "message" => "%{year}-%{month}-%{day}{_,-}%{hour}:%{min}:%{sec} %{msg}"

The {_,-} (a common glob pattern) breaks my parsing. Is there any support for this? Or would I just be better off with two separate filters?

Thanks in advance!


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.