diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 0f171f23455e..8fc6f12b4e3b 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -20,6 +20,7 @@ https://github.com/elastic/beats/compare/v6.6.0...6.x[Check the HEAD diff] - Allow beats to blacklist certain part of the configuration while using Central Management. {pull}9099[9099] - Filesets with multiple ingest pipelines added in {pull}8914[8914] only work with Elasticsearch >= 6.5.0 {pull}10001[10001] +- Add grok pattern to support redis 5.0.3 log timestamp. {issue}9819[9819] {pull}10033[10033] *Heartbeat* diff --git a/filebeat/module/redis/log/ingest/pipeline.json b/filebeat/module/redis/log/ingest/pipeline.json index 637b309c11ed..2701d3486559 100644 --- a/filebeat/module/redis/log/ingest/pipeline.json +++ b/filebeat/module/redis/log/ingest/pipeline.json @@ -5,12 +5,14 @@ "grok": { "field": "message", "patterns": [ - "(%{POSINT:redis.log.pid:long}:%{CHAR:redis.log.role} )?%{REDISTIMESTAMP:redis.log.timestamp} %{REDISLEVEL:redis.log.level} %{GREEDYDATA:redis.log.message}", + "(%{POSINT:redis.log.pid:long}:%{CHAR:redis.log.role} )?(%{REDISTIMESTAMP1:redis.log.timestamp}||%{REDISTIMESTAMP2:redis.log.timestamp}) %{REDISLEVEL:redis.log.level} %{GREEDYDATA:redis.log.message}", "%{POSINT:redis.log.pid:long}:signal-handler \\(%{POSINT:redis.log.timestamp}\\) %{GREEDYDATA:redis.log.message}" ], "pattern_definitions": { "CHAR": "[a-zA-Z]", - "REDISLEVEL": "[.\\-*#]" + "REDISLEVEL": "[.\\-*#]", + "REDISTIMESTAMP1": "%{MONTHDAY} %{MONTH} %{TIME}", + "REDISTIMESTAMP2": "%{MONTHDAY} %{MONTH} %{YEAR} %{TIME}" } } }, @@ -62,6 +64,7 @@ "field": "redis.log.timestamp", "target_field": "@timestamp", "formats": [ + "dd MMM YYYY H:m:s.SSS", "dd MMM H:m:s.SSS", "dd MMM H:m:s", "UNIX" diff --git a/filebeat/module/redis/log/test/redis-5.0.3.log b/filebeat/module/redis/log/test/redis-5.0.3.log new file mode 100644 index 000000000000..e59b6eeab43e --- /dev/null +++ b/filebeat/module/redis/log/test/redis-5.0.3.log @@ -0,0 +1 @@ +26571:M 27 Dec 2018 11:19:18.874 * Synchronization with replica 10.114.208.18:6023 succeeded diff --git a/filebeat/module/redis/log/test/redis-5.0.3.log-expected.json b/filebeat/module/redis/log/test/redis-5.0.3.log-expected.json new file mode 100644 index 000000000000..3aaafd38544f --- /dev/null +++ b/filebeat/module/redis/log/test/redis-5.0.3.log-expected.json @@ -0,0 +1,14 @@ +[ + { + "event.dataset": "redis.log", + "fileset.module": "redis", + "fileset.name": "log", + "input.type": "log", + "offset": 0, + "prospector.type": "log", + "redis.log.level": "notice", + "redis.log.message": "Synchronization with replica 10.114.208.18:6023 succeeded", + "redis.log.pid": "26571", + "redis.log.role": "master" + } +] \ No newline at end of file