Mysqld grok

Example mysqld lines:

2015-06-02 16:27:31 10013 [Note] Blah
2017-09-08T18:39:29.306811Z 281026 [Note]  - Blah

My grok pattern:

MYSQLD_LINE %{TIMESTAMP_ISO8601:[mysql][error][timestamp]}%{SPACE}%{NUMBER:[mysql][error][thread_id]}%{SPACE}\[%{WORD:[mysql][error][level]}\]%{SPACE}%{GREEDYDATA:[mysql][error][message1]}

grokdebug.herokuapp.com claims this grok is good for both lines but when passed to logstash the second one (with the timezone timestamp) doesn't get parsed at all and logstash drops it on the floor. Logstash doesn't match the TIMESTAMP_ISO8601 but it seems as though it should.

Any thoughts?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.