grok pattern for Automation Anywhere timestamp

Question

Hi, I have this (1/15/2018 3:00:32 AM)format for which I was trying to write grok pattern to separate date, time, and AM/PM, Please help. I was using the below pattern but still, don't see the proper out put when creating the index.

grok {

  match => {

      "message" => "%{MONTHDAY}/%{MONTHNUM}/%{YEAR}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?"

  }

}

Answer 1

Hi, the format that you have mentioned has month first and day after that so you'll need to adjust it like this

"%{MONTHNUM}/%{MONTHDAY}/%{YEAR}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?"