Parsing date - day changes number of digits

Elastic Stack Logstash
1

Hi and thanks for reading
I'm building my logstash filter and i just realized that the number of digits in day space changes.
For example:

Oct  2 13:13:13 #two spaces between month and day
Oct 12 22:22:22 #one space between mont and day but two digits for day

If i do this:

date {
    match => [ "real_timestamp", "MMM dd HH:mm:ss"]
    target => "@timestamp"
}

match the second case, but obviously not the first.

What can i do?
Thanks!

2

Indeed, your only option is to specify both patterns like

date {
match => [ "real_timestamp", "MMM dd HH:mm:ss", "MMM  d HH:mm:ss"]
target => "@timestamp"

}

2 Likes
3

Thanks so much, that's right