Cherry-pick 10033 to 6.x: Add grok pattern to support different timestamp fmt in redis log

CHANGELOG.next.asciidoc

@@ -20,6 +20,7 @@ https://github.com/elastic/beats/compare/v6.6.0...6.x[Check the HEAD diff]
 
 - Allow beats to blacklist certain part of the configuration while using Central Management. {pull}9099[9099]
 - Filesets with multiple ingest pipelines added in {pull}8914[8914] only work with Elasticsearch >= 6.5.0 {pull}10001[10001]
+- Add grok pattern to support redis 5.0.3 log timestamp. {issue}9819[9819] {pull}10033[10033]
 
 *Heartbeat*
 

filebeat/module/redis/log/ingest/pipeline.json

@@ -5,12 +5,14 @@
             "grok": {
                 "field": "message",
                 "patterns": [
-                    "(%{POSINT:redis.log.pid:long}:%{CHAR:redis.log.role} )?%{REDISTIMESTAMP:redis.log.timestamp} %{REDISLEVEL:redis.log.level} %{GREEDYDATA:redis.log.message}",
+                    "(%{POSINT:redis.log.pid:long}:%{CHAR:redis.log.role} )?(%{REDISTIMESTAMP1:redis.log.timestamp}||%{REDISTIMESTAMP2:redis.log.timestamp}) %{REDISLEVEL:redis.log.level} %{GREEDYDATA:redis.log.message}",
                     "%{POSINT:redis.log.pid:long}:signal-handler \\(%{POSINT:redis.log.timestamp}\\) %{GREEDYDATA:redis.log.message}"
                 ],
                 "pattern_definitions": {
                     "CHAR": "[a-zA-Z]",
-                    "REDISLEVEL": "[.\\-*#]"
+                    "REDISLEVEL": "[.\\-*#]",
+                    "REDISTIMESTAMP1": "%{MONTHDAY} %{MONTH} %{TIME}",
+                    "REDISTIMESTAMP2": "%{MONTHDAY} %{MONTH} %{YEAR} %{TIME}"
                 }
             }
         },
@@ -62,6 +64,7 @@
                 "field": "redis.log.timestamp",
                 "target_field": "@timestamp",
                 "formats": [
+                    "dd MMM YYYY H:m:s.SSS",
                     "dd MMM H:m:s.SSS",
                     "dd MMM H:m:s",
                     "UNIX"

filebeat/module/redis/log/test/redis-5.0.3.log

@@ -0,0 +1 @@
+26571:M 27 Dec 2018 11:19:18.874 * Synchronization with replica 10.114.208.18:6023 succeeded

filebeat/module/redis/log/test/redis-5.0.3.log-expected.json

@@ -0,0 +1,14 @@
+[
+    {
+        "event.dataset": "redis.log",
+        "fileset.module": "redis",
+        "fileset.name": "log",
+        "input.type": "log",
+        "offset": 0,
+        "prospector.type": "log",
+        "redis.log.level": "notice",
+        "redis.log.message": "Synchronization with replica 10.114.208.18:6023 succeeded",
+        "redis.log.pid": "26571",
+        "redis.log.role": "master"
+    }
+]