Is there any existing grok{} pattern for date format YYYY/MM/DD HH:mm:ss?
I was checking the nginx error logs at our server and found that they start with date formatted as:
2015/08/30 05:55:20
i.e. YYYY/MM/DD HH:mm:ss. I was trying to find an existing grok date pattern which might help me in parsing this quickly but sadly could not find any such date format. Eventually, I had to write the pattern as:
%{YEAR}/%{MONTHNUM}/%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?
I am still hoping if there is a shorter pattern for the same ?
Answer
No. You find the included patterns on github. The comment to datestamp seems to fit to your YYYY/MM/DD, but DATE_US and DATE_EU are different.
I suggest overload the DATE pattern using grok option patterns_dir and go with DATESTAMP.
DATE_YMD %{YEAR}/%{MONTHNUM}/%{MONTHDAY}
DATE %{DATE_US}|%{DATE_EU}|%{DATE_YMD}
or just add your pattern into a patterns-file and use grok's patterns_dir option.