GROK-Date-Parser always parses to January

(Philipp Ruland) #1


I just wanted to ask if I’m alone with this issue:
My timestamp looks like this:

[...].de) on Wed Jul 19 09:38:02 2017.

My GROK looks like this:

[...] on %{GREEDYDATA:syncRuleTimestamp;date;EEE MMM dd HH:mm:ss YYYY}.

But the month is somehow not recognized and seems to be defaulted to January.

When I remove the ;date;EEE MMM dd HH:mm:ss YYYY-part from the GROK-Pattern, you can see that the extracted information would be correct, but the parser doesn’t want the month for some reason :confused:

According to this website, my format-string is correct:

My workaround will be to use the flexible date parser as a second extractor (if this works, can’t test it yet), but my aim is to use the least amount of extractors possible :slight_smile:

So, is there anybody with the same issue? Or am I simply stupid or blind? :smiley:

Greetings - Phil

(Jochen) #2

The Grok extractor is backed by Java’s SimpleDateFormat, correct.

But somehow the website you’re using doesn’t follow the same rules.

In your case, the date pattern is wrong. It should read EEE MMM dd HH:mm:ss yyyy.

Letter Date or Time Component Presentation Examples
y Year Year 1996; 96
Y Week year Year 2009; 09

(system) closed #3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.