title: create a Grok filter for a specific date pattern in logstash
body: <p>I am trying to use ELK stack to store old logs.
  ** This is not a duplicate question. Please read below for details. **
  I want to parse timestamp from my message which looks like below:</p>
  
  <blockquote>
    <p>Apr 1 04:01:04 i-b73lj53l journal: 152.17.62.1 - - [31/Mar/2017:20:01:04 +0000] "GET /api/people/5913b19b31b0f601004875a5?access_token=rNL7S4A2o5BdbX1QDxbL9L5Vx7j60kGIIhQ1tk9yDYRjUf5e8OKzGGnIDTrMXr5n&amp;filter=%7B%22order%22%3A%22createdAt%20DESC%22%2C%22include%22%3A%5B%7B%22relation%22%3A%22friendships%22%2C%22scope%22%3A%7B%22where%22%3A%7B%22trashedAt%22%3A%7B%22exists%22%3Afalse%7D%7D%2C%22include%22%3A%5B%22 HTTP/1.1" 200 346 "<a href="http://api.mywebsite.com/" rel="nofollow noreferrer">http://api.mywebsite.com/</a>" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.104 Safari/537.36 Core/1.53.4549.400 Mozilla/9.7.12900.400"</p>
  </blockquote>
  
  <p>I have tried already for more than <strong>20 hours</strong> and it seems my configuration is not being read at all because even if I add <strong>add_field</strong> or <strong>remove_field</strong>, there is no change in data.</p>
  
  <blockquote>
    <p>I have already enabled system logs as per the documentation filebeat documentation.</p>
  </blockquote>
  
  <p>My std output looks like this:</p>
  
  <pre><code>   DEBUG    [publish]   pipeline/processor.go:275   Publish event: 
  
  
  {
    "@timestamp": "2018-04-05T18:53:08.817Z",
    "@metadata": {
      "beat": "filebeat",
      "type": "doc",
      "version": "6.2.3"
    },
    "source": "/Users/garry/project/sampel",
    "offset": 3231104,
    "tags": [
      "message-log"
    ],
    "prospector": {
      "type": "log"
    },
    "fields": {
      "env": "dev"
    },
    "beat": {
      "name": "Garry-MacBook-Pro-2.local",
      "hostname": "Garry-MacBook-Pro-2.local",
      "version": "6.2.3"
    },
    "message": "Apr 1 04:01:04 i-b73lj53l journal: 152.17.62.1 - - [31/Mar/2017:20:01:04 +0000] "GET /api/people/5913b19b31b0f601004875a5?access_token=rNL7S4A2o5BdbX1QDxbL9L5Vx7j60kGIIhQ1tk9yDYRjUf5e8OKzGGnIDTrMXr5n&amp;filter=%7B%22order%22%3A%22createdAt%20DESC%22%2C%22include%22%3A%5B%7B%22relation%22%3A%22friendships%22%2C%22scope%22%3A%7B%22where%22%3A%7B%22trashedAt%22%3A%7B%22exists%22%3Afalse%7D%7D%2C%22include%22%3A%5B%22 HTTP/1.1" 200 346 "http://api.mywebsite.com/" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.104 Safari/537.36 Core/1.53.4549.400 Mozilla/9.7.12900.400"\"
  }
  </code></pre>
  
  <p>My current config is:</p>
  
  <pre><code>filter {
    grok {
     match =&gt; { "message" =&gt; "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
    }
    date {
      match =&gt; [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z",  "d/MMM/yyyy:HH:mm:ss Z" ]
    }
  }
  </code></pre>