Add a new pattern into grok for Chinese style timestamp

waitspring commented 1 year ago

https://github.com/logstash-plugins/logstash-patterns-core/blob/f01f3f34cfab13a28b0822bdba33db41823cb1d8/patterns/ecs-v1/grok-patterns#L71

Can we add a new pattern into grok for Chinese style timestamp, like 2022-02-22 22:20:20.222.

New pattern maybe named TIMESTAMP_CN, like:

TIMESTAMP_CN %{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}\.\d{3}

This timestamp style is very popular in China. Without the TIMESTAMP_CN, we have to write grok pattern like:

grok {
    match => {
        "message" => [
            "(?<timestamp>%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}\.\d{3}) %{LOGLEVEL:level} \[%{DATA:feature}\] (?<body>.*$)",
            "(?<body>.*$)"
        ]
    }
}

It is too bother!

waitspring commented 1 year ago

@jsvd What do you think about it?

jsvd commented 1 year ago

@waitspring ++ on adding it, can you open a PR with the new pattern, and a simple test in the core_spec.rb file, something like:

describe "TIMESTAMP_CN" do
  let(:value) { '2022-02-22 22:20:20.222' }

  it "matches a Chinese style timestamp format" do
    expect(grok_match(subject, value)).to pass
  end
end

logstash-plugins / logstash-patterns-core

Add a new pattern into grok for Chinese style timestamp #319