GROK-Date-Parser always parses to January

[derPhlipsi (Philipp Ruland)]

Hey,

I just wanted to ask if I’m alone with this issue:
My timestamp looks like this:

[...].de) on Wed Jul 19 09:38:02 2017.

My GROK looks like this:

[...] on %{GREEDYDATA:syncRuleTimestamp;date;EEE MMM dd HH:mm:ss YYYY}.

But the month is somehow not recognized and seems to be defaulted to January.

When I remove the ;date;EEE MMM dd HH:mm:ss YYYY-part from the GROK-Pattern, you can see that the extracted information would be correct, but the parser doesn’t want the month for some reason

According to this website, my format-string is correct:

My workaround will be to use the flexible date parser as a second extractor (if this works, can’t test it yet), but my aim is to use the least amount of extractors possible

So, is there anybody with the same issue? Or am I simply stupid or blind?

Greetings - Phil

[jochen]

The Grok extractor is backed by Java’s SimpleDateFormat, correct.

But somehow the website you’re using doesn’t follow the same rules.

In your case, the date pattern is wrong. It should read EEE MMM dd HH:mm:ss yyyy.

Letter	Date or Time Component	Presentation	Examples
y	Year	Year	1996; 96
Y	Week year	Year	2009; 09