Problem date parsing

Elastic Stack Logstash
1

Hello everybody.
I have a small problem with some type of log annd I need your help.
I couldn't extract the date.

The logs are as follows :

[2017/04/25 15:39:46.255][Info] Block [[Main]][1][ALLOCALL]
[2017/04/25 15:39:46.255][Info] Value '' is assigned to variable [NUMEROCOLORE]
[2017/04/25 15:39:46.255][Info] Jump to block [[Main]][660]

I tried with the following filter but it doesn't work :
match => {"message" => "^%{TIMESTAMP_ISO8601:Date}"}

Thank you for ur help !

2

You have two problems:

  • Your grok expression needs to take into account that your log line starts with [.
  • Your timestamp isn't in ISO8601 format so you can't use TIMESTAMP_ISO8601.
3

Is that better :
match => {"message" => "[%{YEAR}/%{MONTH}/%{MONTHDAY} %{TIME}]:Time"}

It doesn't work also.

4

Try this expression:

^\[(?<Time>%{YEAR}/%{MONTHNUM}/%{MONTHDAY} %{TIME})\]...
5

It's work ! Thank you very much !!!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.