CODEWITHSUNDEEP
logstashlogstash-grok
pdna
pdna

Reputation: 602

Grok custom time format

I have a time format like below. 

2017-10-15T06:25:02.186227-04:00

This seems to work partially %{NUMBER:year}-%{MONTHNUM:month}-%{MONTHDAY:day}T%{HOUR:hour}:%{MINUTE:minutes}.%{SECOND:second}

Upvotes: 0

Views: 1044

Answers (1)

Will Barnwell
Will Barnwell

Reputation: 4089

Your pattern should work with a colon before the second pattern up until what i assume is a timezone. Then we can use a custom field capture for that.

%{NUMBER:year}-%{MONTHNUM:month}-%{MONTHDAY:day}T%{HOUR:hour}:%{MINUTE:minutes}:%{SECOND:second}(?<timezone>[+-]\d{2}:\d{2})

Upvotes: 1

Related Questions