From 8a1ce205621d4141598d4b2562dde0f97fc4b3e0 Mon Sep 17 00:00:00 2001 From: Rock-HOG <10247631+Rock-HOG@users.noreply.github.com> Date: Tue, 29 May 2018 11:08:13 -0700 Subject: [PATCH] adds lowercase to TZ pattern some log entries may show lowercase timezone. --- patterns/grok-patterns | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/patterns/grok-patterns b/patterns/grok-patterns index 3e4539b8..875eb574 100644 --- a/patterns/grok-patterns +++ b/patterns/grok-patterns @@ -71,7 +71,7 @@ ISO8601_SECOND (?:%{SECOND}|60) TIMESTAMP_ISO8601 %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}? DATE %{DATE_US}|%{DATE_EU} DATESTAMP %{DATE}[- ]%{TIME} -TZ (?:[APMCE][SD]T|UTC) +TZ (?:[AaPpMmCcEe][SsDd][Tt]|UTC|utc) DATESTAMP_RFC822 %{DAY} %{MONTH} %{MONTHDAY} %{YEAR} %{TIME} %{TZ} DATESTAMP_RFC2822 %{DAY}, %{MONTHDAY} %{MONTH} %{YEAR} %{TIME} %{ISO8601_TIMEZONE} DATESTAMP_OTHER %{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{TZ} %{YEAR}