Logstash - filter message

[rockyu]

If my logs is 2020-03-26-12:12:36 aaa, I want to filter out the date like 2020-03-26-12:12:36 ,How can I do it ? My config is

grok {
      match => {"message => (?<date>([0-9|-]\S+[0-9|:]\S+)"}
      add_field => {
              "times" => "%{date}"
              }
      }

[A_B]

Hi @rockyu,

If you use e.g. Kibana, there is a Grok Debugger where you can test GROK patterns.

Something like this should work

grok {
      match => { "message" => "(?<times>%{YEAR}-%{MONTHNUM}-%{MONTHDAY}-%{HOUR}:%{MINUTE}:%{SECOND}) %{DATA:string}$" }
      }

That gave me this result

{
  "times": "2020-03-26-12:12:36",
  "string": "aaa"
}

[rockyu]

Thanks for helping to solve this problem