Search code examples
logstashkibanaelastic-stacklogstash-grok

Grok formatting for a custom timestamp


[04-21 12:57:04]

this is the timestamp generated by python written logs. I hav tried

SYSLOGTIMESTAMP, DATESTAMP_EVENTLOG, DATESTAMP_RFC2822,TIMESTAMP_ISO8601

and many more. Can anyone please provide the correct grok format for this. If not possible how can i use this as a timestamp


Solution

  • You can try these Groks:

    \[(?<timestamp>%{MONTHNUM}-%{MONTHDAY} %{TIME})\]
    

    or

    \[(?<timestamp>[^\]]+)\]