Simple Grok and Date filter problem

[Badger]

@Tim3

grok {
match => { "message" => "%{DATESTAMP:LogDate} %{WORD:LogType} - %{WORD:MachineNumber} %{GREEDYDATA:Message}" }
}

DATESTAMP matches a two digit year. If you try to anchor that pattern to beginning of line

"^%{DATESTAMP:LogDate} %{WORD:LogType} - %{WORD:MachineNumber} %{GREEDYDATA:Message}"

then you get a _grokparsefailure. I would use dissect instead of grok.

dissect { mapping => { "message" => "%{LogDate} %{+LogDate} %{LogType} - %{MachineNumber} %{Message}" } }