Logstash grok pattern for date

0
votes

I have the logs in the following format and I want to parse the date out of it using the logstash grok pattern in logstash filter:

[31/1/20 4:31:31:697 IST]

Can anyone help me with this?

1
logstashkibanalogstash-grok

1 Answers

0
votes

This solution must work (put it in your configuration file of logstash) :

filter{
grok {
   match => { "field" => "\[%{DATESTAMP:date} %{WORD:code}\]" }
 }
}

Be carefull, your second value looks like strange (31:697)

You could debug the grok pattern with the online tool grokdebug.