grok pattern for Automation Anywhere timestamp

Question

Hi I have the above format for which I was trying to write grok pattern to seperate date, time, and AM/PM , Please help. I was using below pattern but still don't see the proper out put when create the index.

grok {
  match => {
      "message" => "%{MONTHDAY}/%{MONTHNUM}/%{YEAR}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?"
  }
}

Answer 1

The first number is a month and the second is the day, since it's above 12. So you'll have to switch %{MONTHDAY} & %{MONTHNUM} like this:

"%{MONTHNUM}/%{MONTHDAY}/%{YEAR}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?"