Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Grok pattern for ISO 8601 datestamp #5232

Merged
merged 2 commits into from
Aug 19, 2024
Merged

Add Grok pattern for ISO 8601 datestamp #5232

merged 2 commits into from
Aug 19, 2024

Conversation

philrz
Copy link
Contributor

@philrz philrz commented Aug 19, 2024

What's Changing

Adding a grok pattern for a date of the format 2024-08-15.

Why

A user went looking for such a pattern in a recent community Slack thread and indeed one didn't exist in our set of included patterns.

Details

While I showed the user how to define/use one immediately via Grok's optional third definitions argument, this pattern seems common enough that it's worth adding to our included base set.

I've done a fair amount of timestamp-related research lately while putting together the write-up in #5221, so I put a little extra throught into the name of this pattern, e.g., should it be DATESTAMP_ISO8601 or something else like DATESTAMP_RFC3339. However, I went with the former because:

  1. A date of this format is the top entry at https://en.wikipedia.org/wiki/ISO_8601, and,
  2. RFC3339 is considered a "profile" of ISO 8601, making ISO 8601 the "wider umbrella" thing to reference

Copy link
Collaborator

@mattnibs mattnibs left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was skeptical about adding this since it's not included in grok-patterns for logstash, but then again we do have extra base rules extended beyond logstash and being that this is a subset of TIMESTAMP_ISO8601 so I don't think it hurts to add this as well.

pkg/grok/base.go Outdated Show resolved Hide resolved
Co-authored-by: Matthew Nibecker <hello@mattnibecker.com>
@philrz philrz merged commit 63c5778 into main Aug 19, 2024
3 checks passed
@philrz philrz deleted the grok-datestamp-iso8601 branch August 19, 2024 21:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants