Add Grok pattern for ISO 8601 datestamp #5232
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What's Changing
Adding a
grok
pattern for a date of the format2024-08-15
.Why
A user went looking for such a pattern in a recent community Slack thread and indeed one didn't exist in our set of included patterns.
Details
While I showed the user how to define/use one immediately via Grok's optional third
definitions
argument, this pattern seems common enough that it's worth adding to our included base set.I've done a fair amount of timestamp-related research lately while putting together the write-up in #5221, so I put a little extra throught into the name of this pattern, e.g., should it be
DATESTAMP_ISO8601
or something else likeDATESTAMP_RFC3339
. However, I went with the former because: