Example mysqld lines:
2015-06-02 16:27:31 10013 [Note] Blah
2017-09-08T18:39:29.306811Z 281026 [Note] - Blah
My grok pattern:
MYSQLD_LINE %{TIMESTAMP_ISO8601:[mysql][error][timestamp]}%{SPACE}%{NUMBER:[mysql][error][thread_id]}%{SPACE}\[%{WORD:[mysql][error][level]}\]%{SPACE}%{GREEDYDATA:[mysql][error][message1]}
grokdebug.herokuapp.com claims this grok is good for both lines but when passed to logstash the second one (with the timezone timestamp) doesn't get parsed at all and logstash drops it on the floor. Logstash doesn't match the TIMESTAMP_ISO8601 but it seems as though it should.
Any thoughts?