# Logstash grok

**URL:** <https://discuss.elastic.co/t/logstash-grok/280779>\
**Category:** Logstash\
**Created:** [August 9, 2021, 8:59am UTC](https://discuss.elastic.co/t/logstash-grok/280779 "2021-08-09T08:59:51Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![KaPBaJIOJI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kapbajioji/32/79243_2.png) [@KaPBaJIOJI](https://discuss.elastic.co/u/KaPBaJIOJI)\
**Post date:** [August 9, 2021, 8:59am UTC](https://discuss.elastic.co/t/logstash-grok/280779/1 "2021-08-09T08:59:51Z")

</div>

Good afternoon to everyone, my question is quite simple, but I'm still quite new to the elk stack. it is necessary to digest the expression through the grok filter

```auto
Mon Aug 9 15:18:25 +07 2021 mail 0

```

the date passes normally

> `%{SYSLOGTIMESTAMP}`

then need to exclude the following columns `+07 and 2021`

if I delete these columns +07 and 2021, then the filter passes  
and

> %{SYSLOGTIMESTAMP} %{HOSTNAME}

it s works  
but I need the grok filter to recognize the date itself, delete the columns `+07 2021` and then recognize the hostname and the number.  
I apologize if I wrote in a confused way.  
p.s.  
i am changed format date, now it has the form  
`Mon Aug 9 17:21:26 mail 0`

The topic can be closed  
my filter  
`%{SYSLOGTIMESTAMP} %{HOSTNAME} %{NUMBER:value:int}` work))

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [August 9, 2021, 12:59pm UTC](https://discuss.elastic.co/t/logstash-grok/280779/2 "2021-08-09T12:59:04Z")

</div>

The `SYSLOGTIMESTAMP` is a built in pattern that really means `%{MONTH} +%{MONTHDAY} %{TIME}`. As you can see this doesn't match your pattern and you can create your own like in the example below.

`(?<timestamp>%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{DATA} %{YEAR}) %{DATA:hostname} %{NUMBER:value:int}`

[Grok Pattern Reference](https://github.com/hpcugent/logstash-patterns/blob/master/files/grok-patterns)

---

<div class="post-metadata">

**Author:** ![KaPBaJIOJI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kapbajioji/32/79243_2.png) [@KaPBaJIOJI](https://discuss.elastic.co/u/KaPBaJIOJI)\
**Post date:** [August 10, 2021, 3:19am UTC](https://discuss.elastic.co/t/logstash-grok/280779/3 "2021-08-10T03:19:29Z")

</div>

Thanks for help, rly your example work, just need to add a space between  
`%{MONTH} %{MONTHDAY}`  
Thankyou

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 10, 2021, 3:23am UTC](https://discuss.elastic.co/t/logstash-grok/280779/4 "2021-08-10T03:23:06Z")

</div>

Well, you more likely want

```
%{MONTH} +%{MONTHDAY}

```

which will match "one or more" spaces between the month and the day.

---

<div class="post-metadata">

**Author:** ![KaPBaJIOJI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kapbajioji/32/79243_2.png) [@KaPBaJIOJI](https://discuss.elastic.co/u/KaPBaJIOJI)\
**Post date:** [August 10, 2021, 3:28am UTC](https://discuss.elastic.co/t/logstash-grok/280779/5 "2021-08-10T03:28:49Z")

</div>

Thanks for help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 7, 2021, 3:28am UTC](https://discuss.elastic.co/t/logstash-grok/280779/6 "2021-09-07T03:28:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.