ElasticSearch带Grok模式日期戳的摄取管道

当模拟ElasticSearch接收管道以处理表单中的时间戳时 Thu, 19 Sep 2019 20:28:58 GMT ,Grok无法使用 DATESTAMP_RFC2822 pattern .

关于我在这里遗漏了什么有什么建议吗?

例子:

POST _ingest/pipeline/_simulate
{
  "pipeline" :
  {
    "description": "testing...",
    "processors" : [
      {
        "grok" : {
          "field" : "message",
          "patterns" : [
            "%{DATESTAMP_RFC2822:initial_date}"
          ],
          "on_failure" : [
            {
              "set" : {
                "field" : "error",
                "value" : "{{ _ingest.on_failure_message }}"
              }
            },
            {
              "set" : {
                "field" : "grok_error",
                "value" : true
              }
            }
          ]
        }
      }
    ]
  },
  "docs": [
    {
      "_index": "index",
      "_id": "1",
      "_source": {
        "message": "Thu 19 Sep 2019 20:28:58 GMT"
      }
    }
  ]
}

…结果是:

"Provided Grok expressions do not match field value: [Thu 19 Sep 2019 20:28:58 GMT]",