With logstash and grok, how can I split TIME into hour, minute and second?

Question

I have a field that can look like this: 23:59:47

I tried using %{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second} as a pattern, but that gives me the generic grokparsefailure.

{TIME:time} works well, but I want hour, minute and second.

filter {
  grok {
    match => {"message" => "%{DATE:date} %{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second} %{GREEDYDATA:logMessage}"}
  }
}

Tried 23:59:47 and %{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second} at https://grokdebug.herokuapp.com/ and it works. Can you put in the complete line with the date that you are trying to parse — Yogesh_D, Sep 24 '15 at 09:47
Using http://grokdebug.herokuapp.com/ with 23:59:57 as input and %{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second} as filter. I do retrieve each field separatly. But if I use your complete filter, then there's no match. Can you as well provide a full line as input please ? — vdolez, Sep 24 '15 at 09:47
The problem may occur because you're trying to parse a date AND a time and I think the time may be included in the first date field. — vdolez, Sep 24 '15 at 09:51

score 2 · Accepted Answer · answered Apr 27 '17 at 15:08

I know this is quite an old question, but I just had the same query and TIME seems to work now.

Using https://grokdebug.herokuapp.com/ with 23:59:57 as input and %{TIME:timestamp} as filter gives me the original plus separate fields for HOUR, MINUTE and SECOND

With logstash and grok, how can I split TIME into hour, minute and second?

1 Answers1