Help with grok from a log with date MM/dd/yyyy hh:mm:ss AM/PM

[MarcV]

Hi @daniel,
Nice !

Probably the custom_patterns Is not required with your solution ?

[daniel]

You still will need the DATESTAMP_AMPM pattern, it’s a two step process: first match the date string with the DATESTAMP_AMPM regular expression, then interpret the date string as a time with ts-"1/2/2006 3:04:05 PM".