Timestamp replacing with format MMM dd HH:mm:ss yyyy

Elastic Stack Logstash
1

Hi, I'm Calebe and I'm trying to replace the timestamp with the timestamp from the log file.

I tried so many things and nothing works.

I have this kind of timestamp in my log file:
Jun 24 19:34:54 2016

The problem is that I don't know the correct configure for grok filter.

I'm using this:

filter {

grok {
match => [ "message" => %{SYSLOGBASE:timedate} ]
}
date {
match => [ "timedate" , "MMM dd HH:mm:ss yyyy" ]
}
}

It's not working. I think that's because grok is configured wrong, but I can't find the right way.

Could anyone please help me?

2

I tride this different way and didn't work either.

filter {

grok {
match => [ "message" => "^(?%{MONTH:month} %{MONTHDAY:day} %{TIME:time} %{YEAR:year})" ]
add_field => {"timestamp" => "%{day}-%{month}-%{year} %{time}"}
remove_field => [ "day", "month", "year", "time" ]
}

date {
match => [ "timestamp" , "MMM dd HH:mm:ss yyyy" ]
remove_field => "timestamp"
}
}

3

@calebereis,

The SYSLOGBASE will add another filed and you can use that filed to check the date and time when that log was generated at source machine.

Try the below config:

filter {
grok {
match => { "message" => ["SYSLOGBASE"] }
}
}

It will add a filed with name SYSLOGTIMESTAMP on kibana. You can refer that filed.

Thanks.

4

Hi Tek,

I tried doing that, but I got _grokparsefailure.

Should I add the date filter refering to this new field?

5

@Calebereis, Can you please provide the output or error log?
That will be helpful to troubleshoot the issue.

Thanks.

6

After so many tries, I found something that works.

filter {
  grok {
    match => { "message" => "^%{MONTH:mes}\s*%{MONTHDAY:dia}\s*%{TIME:hora}\s*%{YEAR:ano}:\s.*%{IP:ip}" }
  }
  mutate {
     add_field => {
        "timedate" => "%{mes} %{dia} %{hora} %{ano}"
    }
  }
}

And now I can receive my txt file and read it in the right time.

Thank you anyway, Tek.

Hope it helps someone else.

1 Like
7

@calebereis, Glad to hear that. :slight_smile:

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.