Merge pull request #395 from splunk/fix/f_f5_bigip_message

f5 message filter single digit date
CSVD · Apr 6, 2020 · aea7139 · aea7139
2 parents e467a18 + 5b06616
commit aea7139
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/package/etc/conf.d/filters/f5/bigip.conf.tmpl b/package/etc/conf.d/filters/f5/bigip.conf.tmpl
@@ -8,7 +8,7 @@ filter f_f5_bigip {
 };
 filter f_f5_bigip_message {
     message(
-        '^(?i)(<\d+> ?[[:alpha:]]+ \d\d \d\d:\d\d:\d\d +[^ ]+) +(?:notice|err|error|warning|info) +?(.*)'
+        '^(?i)(<\d+> ?[[:alpha:]]+\s{1,2}\d{1,2} \d\d:\d\d:\d\d +[^ ]+) +(?:notice|err|error|warning|info) +?(.*)'
         flags(store-matches)
     );
 };