Unable to parse datestamp

[Nikhil_Pillai (Nikhil)]

Hi,

Unable to parse datestamp as per the following log pattern.
[03/05/19 05:38:00:000 IST] ERROR scheduler.EDISFileReaderTask: @@ Scheduler StepNumber 3 (incoming folder is empty OR it doesn't have EXCEL files) @@

Parsing works in online grok debugger but doesn't work with the grok debugger available in kibana one.

[%{DATESTAMP} %{WORD:TimeZone}] %{WORD:LogLevel} %{DATA:JAVACLASS}: %{GREEDYDATA:message}

Anyone faced similar issue and what was their workaround.

Regards,
Nikhil

[Badger]

I would do that with dissect rather than grok

dissect { mapping => { "message" => "[%{timestamp} %{+timestamp} %{timezone}] %{loglevel} %{class} %{restOfLine}" } }

[Nikhil_Pillai (Nikhil)]

@Nikhil_Pillai

[%{DATESTAMP} %{WORD:TimeZone}] %{WORD:LogLevel} %{DATA:JAVACLASS}: %{GREEDYDATA:message}

Was able to make it work using the following grok pattern but thanks anyway.
[%{DATESTAMP:timestamp} %{WORD:TimeZone}] %{WORD:LogLevel} %{JAVACLASS:JAVACLASS}: %{GREEDYDATA:message}

Close thread...

Regards,
Nikhil