Back

Explore Courses Blog Tutorials Interview Questions
0 votes
2 views
in RPA by (5.3k points)

Hi I have the above format for which I was trying to write grok pattern to seperate date, time, and AM/PM , Please help. I was using below pattern but still don't see the proper out put when create the index.

grok {
  match => {
      "message" => "%{MONTHDAY}/%{MONTHNUM}/%{YEAR}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?"
  }
}

1 Answer

0 votes
by (9.5k points)

The first number is a month and the second is the day, since it's above 12. So you'll have to switch %{MONTHDAY} & %{MONTHNUM} like this:

"%{MONTHNUM}/%{MONTHDAY}/%{YEAR}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?"

Related questions

Browse Categories

...