logging - Formatting Windows timestamp using Logstash -


i have integrated windows event logs logstash. timestamp on windows event logs looks this: 20131007071942.087375-000

to convert timestamp readable 1 have used date filter on logstash.

date{   match => [ "timegenerated", "yyyymmddhhmmss.ssssss-sss" ] } 

this gives me error :

 ←[33mfailed parsing date field {:field=>"timegenerated", :value=>"20131007080720.040037- 000", :exception=>java.lang.illegalargumentexception: invalid format: "20131007080720.040037- 000" short, :level=>:warn}←[0m 

it great if me fix this. thanks

try using grok debugger:

http://grokdebug.herokuapp.com/

and looking @ existing regex patterns: https://github.com/logstash/logstash/tree/master/patterns

to started:

%{year:yyyy}%{monthnum:mm}%{monthday:dd}%{greedydata:remainder}


Comments

Popular posts from this blog

java.util.scanner - How to read and add only numbers to array from a text file -

rewrite - Trouble with Wordpress multiple custom querystrings -

php - Accessing static methods using newly created $obj or using class Name -