CODEWITHSUNDEEP
logstashlogstash-grok
Perepo
Perepo

Reputation: 1

Logstash Grok parsing timestamp field

Quite new to grok and struggling to parse the following date time

[170316 03:51:03.102][Columbia.SIMPLY][WS_D_001]

I have tried to parse the first datetime field with the predefined date time patterns without success. The format is YYMMDD HH:MM:SS.

Maybe a custom pattern for this is needed ?

Anyone can help? many thanks!

Upvotes: 0

Views: 777

Answers (1)

Val
Val

Reputation: 217254

The following grok pattern will correctly parse your log line:

grok {
    match => {"message" => "\[(?<year>\d{2})%{MONTHNUM:month}%{MONTHDAY:day} %{TIME:time}\]\[%{GREEDYDATA:message1}\]\[%{GREEDYDATA:message2}\]"}
}

Upvotes: 1

Related Questions