Adding DATE_8601 to the list of default Grok patterns #124
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
On line 65 of this pattern file is the following comment:
It turns out the format in this comment isn't actually covered with YYYY MM DD with any other delimiter other than hyphens such as in
TIMESTAMP_ISO8601
.There are a lot of log files that contain
YYYY/MM/DD
, not just the officialISO8601
time stampYYYY-?MM-?DD
.I made the
DATE_8601
pattern and suffixed it to theDATE
pattern so whenDATESTAMP
is use, it covers all three common use formats. TheYYYY MM DD
is in used in China, Korea, Taiwan, Hungary, Iran, Japan, Lithuania due toISO 8601
. Also plenty of other countries use this format. I think for completeness of the basic date patterns it has a place here with all three common delimiters.I think perhaps
DATE_8601
is the wrong name for this pattern. Using slashes or dot delimiters is not an official 8601 format according to ISO8601.I'm suspecting we should change this, but I don't know what a suitable suffix would be as it's hard to aggregate the aforementioned countries into a region code like the other date patterns in the file.