I have an interesting problem that I cannot seem to solve. I have some Palo Alto firewalls sending traffic log data to a Graylog instance, which was working fine for quite a while. I am using a Grok pattern to parse the data. A few fields have time data in them in the following format:
Unfortunately this is no longer working and the following error is displayed from ElasticSearch:
MapperParsingException[failed to parse [panos_traffic_generated_time]]; nested: IllegalArgumentException[Invalid format: “2017/04/06 08:08:34” is malformed at “/04/06 08:08:34”];
Any ideas on how to resolve this? The log format from the Palo Alto has not changed.