PNDA-4860: Some logs coming into Kibana are big aggregated blob rathe…

…r than time series
pndaproject · Aug 13, 2018 · 2ff00d5 · 2ff00d5
1 parent ddf768a
commit 2ff00d5
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/salt/logserver/logshipper_templates/shipper.conf.tpl b/salt/logserver/logshipper_templates/shipper.conf.tpl
@@ -11,7 +11,7 @@ input {
           add_field => {"source" => "knox"}
           sincedb_path => "{{ install_dir }}/logstash/sincedb/db"
           codec => multiline {
-            pattern => "^%{TIMESTAMP_ISO8601}"
+            pattern => "^%{YEAR}[-/]%{MONTHNUM}[-/]%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?"
             negate => true
             what => "previous"
           }