@Mark_S You will need to do some additional parsing and be sure to add the correct timezone ... The timezone will default to your local timezone. If it's something different you need to set it.
here is a sample
input {
file {
path => "/Users/sbrown/workspace/sample-data/discuss/test-logstash-timestamp.log"
start_position => "beginning"
sincedb_path => "/dev/null"
codec => multiline {
# Grok pattern names are valid! :)
pattern => "^%{TIMESTAMP_ISO8601} "
negate => true
what => "previous"
}
}
}
filter{
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:log_timestamp} %{DATA:message_detail}" }
}
date {
match => [ "log_timestamp", "ISO8601" ]
# Set Time Zone since log does not have it, otherwise it will use local time zone
timezone => "PST8PDT"
}
}
output {
stdout { codec => rubydebug }
}
Sample
{
"log" => {
"file" => {
"path" => "/Users/sbrown/workspace/sample-data/discuss/test-logstash-timestamp.log"
}
},
"@timestamp" => 2023-03-12T17:48:14.003Z,
"log_timestamp" => "2023-03-12 10:48:14.003",
"host" => {
"name" => "hyperion"
},
"event" => {
"original" => "2023-03-12 10:48:14.003 WARN -- extra-characters .blahblah Test-Info:[protocol=HTTP/1.1, uname=test-camel-svc, method=PUT, registert=02384827, server=TESTVM9:8083, tracker_id=84d9d0231-2231-4a11-5e2d-88afa5ee12c6, bda_id=4352, testbda_id=?/?, cause=incoming_request, calling_server=XX.XXX.XXX.XXX, request_time=N/A, reception_date=2020-01-00T01:00:00.000+0000, time_elapsed_ms=37] 3123344 --- [XNIO-1 task-1] g.u.m.commons.logging.MDCLoggingFilter : processing_end, processing_end some more-characters-here"
},
"message_detail" => "WARN -- extra-characters .blahblah Test-Info:[protocol=HTTP/1.1, uname=test-camel-svc, method=PUT, registert=02384827, server=TESTVM9:8083, tracker_id=84d9d0231-2231-4a11-5e2d-88afa5ee12c6, bda_id=4352, testbda_id=?/?, cause=incoming_request, calling_server=XX.XXX.XXX.XXX, request_time=N/A, reception_date=2020-01-00T01:00:00.000+0000, time_elapsed_ms=37] 3123344 --- [XNIO-1 task-1] g.u.m.commons.logging.MDCLoggingFilter : processing_end, processing_end some more-characters-here",
"message" => "2023-03-12 10:48:14.003 WARN -- extra-characters .blahblah Test-Info:[protocol=HTTP/1.1, uname=test-camel-svc, method=PUT, registert=02384827, server=TESTVM9:8083, tracker_id=84d9d0231-2231-4a11-5e2d-88afa5ee12c6, bda_id=4352, testbda_id=?/?, cause=incoming_request, calling_server=XX.XXX.XXX.XXX, request_time=N/A, reception_date=2020-01-00T01:00:00.000+0000, time_elapsed_ms=37] 3123344 --- [XNIO-1 task-1] g.u.m.commons.logging.MDCLoggingFilter : processing_end, processing_end some more-characters-here",
"@version" => "1"
}