# Logstash Grok Pattern for Timestamp with Timezone

**URL:** <https://discuss.elastic.co/t/logstash-grok-pattern-for-timestamp-with-timezone/266268>\
**Category:** Logstash\
**Created:** [March 4, 2021, 5:26pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-for-timestamp-with-timezone/266268 "2021-03-04T17:26:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kosodrom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kosodrom/32/99278_2.png) [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\
**Post date:** [March 4, 2021, 5:26pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-for-timestamp-with-timezone/266268/1 "2021-03-04T17:26:13Z")

</div>

Hi,

I am trying to match following logs for icinga2 using grok filter:

```
[2021-03-04 17:03:27 +0100] warning/GraphiteWriter: Ignoring invalid perfdata for checkable 'host!service' and command 'by_ssh' with value: /foo/bar=4242MiB;9203;9714;0;10226
Context:
	(0) Processing check result for 'host!service'

```

I am trying to use following grok expression:

`%{TIMESTAMP_ISO8601:timestamp}] %{WORD:log_level}/%{WORD:component}: %{GREEDYDATA:message}`, which fails because of the "wrong" timestamp format.

**As soon as I remove `+0100` from the timestamp the filter works (except of the broken multilines)**.

```
[2021-03-04 17:03:27] warning/GraphiteWriter: Ignoring invalid perfdata for checkable 'host!service' and command 'by_ssh' with value: /foo/bar=4242MiB;9203;9714;0;10226
Context:
	(0) Processing check result for 'host!service'

```

becomes:

```
{
  "component": "GraphiteWriter",
  "log_level": "warning",
  "message": "Ignoring invalid perfdata for checkable 'host!service' and command 'by_ssh' with value: /foo/bar=4242MiB;9203;9714;0;10226\r",
  "timestamp": "2021-03-04 17:03:27"
}

```

Is there any other timestamp filter I can use to parse the date correctly?

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 4, 2021, 5:59pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-for-timestamp-with-timezone/266268/2 "2021-03-04T17:59:20Z")

</div>

> [@Kosodrom](#):
>
> TIMESTAMP\_ISO8601

That pattern does not allow a space before the timezone. You could use mutate+gsub to remove it.

```
mutate { gsub => ["message", "(:\d\d) (+\d{4}\])", "\1\2" ] }

```

---

<div class="post-metadata">

**Author:** ![Kosodrom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kosodrom/32/99278_2.png) [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\
**Post date:** [March 8, 2021, 1:49pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-for-timestamp-with-timezone/266268/3 "2021-03-08T13:49:18Z")

</div>

Hey, thanks for the hint. Unfortunatelly this ends up in an error:

`RegexpError: target of repeat operator is not specified: /(:\d\d) (+\d{4}\])/>`

Did you ment` (:\d\d) (\+\d{4}\])` for the regex pattern, because this works fine. Thank you!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 8, 2021, 4:59pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-for-timestamp-with-timezone/266268/4 "2021-03-08T16:59:35Z")

</div>

Yes. + is a meta-character that means "one or more" of the preceding character. Since it is the first character inside the capture group (parentheses) there is no target for it. You do indeed need to escape it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 5, 2021, 5:00pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-for-timestamp-with-timezone/266268/5 "2021-04-05T17:00:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.