GROK Pattern for timestamp


I try to get a special log parsed which is pipe delimited. One of the fields consists of the following timestamp layout:

22:05:47,730 CET 02/23/2021

Does somebody now how to dissect this one? I have the hardest time with the space in front of the TIMEZONE.

So apparently just asking the question helped. I am now a but further. The CET seems to be no parsed with the TZ (timezone pattern) But with something as simple as {WORD} or CET it does.

(?<date>%{HOUR}:%{MINUTE}:%{SECOND} %{WORD})

Now let’s look at the date

%{DATE_US} should capture it