Logstash grok filter custom date -


im working on writing logstash grok filter syslog messages coming synology box. example message looks this.

jun  3 09:39:29 diskstation connection user:\tuser [user] logged in [192.168.1.121] via [dsm]. 

im having hard time filtering out weirdly formatted timestamp. give me helping hand here? have far.

if [type] == "syslog" , [message] =~ "diskstation" {     grok {       match => [ "message", "%{hostname:hostname} %{word:program} %{greedydata:syslog_message}" ]     }   } 

as can tell havent dealt timestamp yet @ all. appreciated.

the following config can parse log.

grok {     match => [ "message", "%{syslogtimestamp:date} %{hostname:hostname} %{word:program} %{greedydata:syslog_message}" ] } 

you can try log , pattern @ here , refer provided pattern @ here.


Comments