title: Grok filter for a time counter HH:MM
body: <p>I'm quite new to ELK and Grok-filtering, and I'm struggling with parsing this particular pattern in my grok filter. </p>
  
  <p>I've used the <a href="https://grokdebug.herokuapp.com/" rel="nofollow noreferrer">grok debugger</a> to try and solve this, but although I like the tool, I just get confused by the custom patterns. </p>
  
  <p>Eventually, I hope to parse lots of log files sent by filebeat to logstash, then send the parsed logs to elasticsearch and display with kibana or some similar visualization tool. </p>
  
  <p>The lines that I need to parse follow the following pattern:</p>
  
  <pre><code>1310 2017-01-01 16:48:54 [325:51] [326:49] [359:57] Some log info text
  </code></pre>
  
  <ul>
  <li>The first four digits is a log type identifier, and will be used for grouping. I've called the field "LogLineID". </li>
  <li>The date is formatted YYYY-MM-DD HH:MM:SS, and is parsed ok. I called the field "LogDate".</li>
  <li>But now the problem begins. Within the square brackets, I have counters, formatted as MM:SS if you like. I cannot for the life of me find a way to sort these out, but I need to compare these times, hence I want to store them as minutes and seconds, not just numbers.
  
  <ul>
  <li>The first is a counter "TimeSpent", </li>
  <li>the second is a counter "TimeStarted" and </li>
  <li>the third is a counter "TimeSinceDown". </li>
  </ul></li>
  <li>Then, last, comes the info text, which I've managed to grok with simply applying %{GREEDYDATA:LogInfo}.</li>
  </ul>
  
  <p>I notice that the amount of minutes could be far higher than the standard 60 minutes within an hour, so I may be barking up the wrong tree here trying to parse it with date patterns such as TIMESTAMP_ISO8601, but then, I don't really know how else to do this.</p>
  
  <p>So, I came this far: </p>
  
  <pre><code>%{NUMBER:LogLineID} %{TIMESTAMP_ISO8601:LogDate}
  </code></pre>
  
  <p>and were as mentioned able to (by cutting away the square bracket parts) to parse the log info text with </p>
  
  <pre><code>%{GREEDYDATA:LogInfo}
  </code></pre>
  
  <p>to create a field LogInfo.</p>
  
  <p>But that's were I'm stuck. Could someone please help me figure out the rest?</p>
  
  <p>Massive thanks in advance.</p>
  
  <p>PS! I also found <a href="https://qbox.io/blog/logstash-grok-filter-tutorial-patterns" rel="nofollow noreferrer">%{NUMBER:duration}</a>, but it could as far as I could tell only parse timestamps with dot, not colon..</p>