Logstash - Grok 过滤器 - 是否可以命名聚合模式

Question

I've got this time stamp in one of the logs

Tue Mar 29 09:47:33 2016

I've looked into the built in patterns https://github.com/elastic/logstash/blob/v1.4.2/patterns/grok-patterns

But couldn't find an exact match.

I know I can create my custom pattern.. But I would still like to resolve it cleaner at the filter level.

I was thinking of a grok pattern in this format:

%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}

But not sure how to name it matched it to a single name

Answer 1

知道了...

(?<sourceTimestamp>%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR})