Add grok pattern to support different timestamp fmt in redis log

CHANGELOG.next.asciidoc

@@ -33,6 +33,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Rename a few `mysql.*` fields to map to ECS. {pull}10008[10008]
 - Rename a few `nginx.error.*` fields to map to ECS. {pull}10007[10007]
 - Filesets with multiple ingest pipelines added in {pull}8914[8914] only work with Elasticsearch >= 6.5.0 {pull}10001[10001]
+- Add grok pattern to support redis 5.0.3 log timestamp. {issue}9819[9819] {pull}10033[10033]
 
 *Heartbeat*
 

filebeat/module/redis/log/ingest/pipeline.json

@@ -5,12 +5,14 @@
             "grok": {
                 "field": "message",
                 "patterns": [
-                    "(%{POSINT:process.pid:long}:%{CHAR:redis.log.role} )?%{REDISTIMESTAMP:redis.log.timestamp} %{REDISLEVEL:log.level} %{GREEDYDATA:message}",
+                    "(%{POSINT:process.pid:long}:%{CHAR:redis.log.role} )?(%{REDISTIMESTAMP1:redis.log.timestamp}||%{REDISTIMESTAMP2:redis.log.timestamp}) %{REDISLEVEL:log.level} %{GREEDYDATA:message}",
                     "%{POSINT:process.pid:long}:signal-handler \\(%{POSINT:redis.log.timestamp}\\) %{GREEDYDATA:message}"
                 ],
                 "pattern_definitions": {
                     "CHAR": "[a-zA-Z]",
-                    "REDISLEVEL": "[.\\-*#]"
+                    "REDISLEVEL": "[.\\-*#]",
+                    "REDISTIMESTAMP1": "%{MONTHDAY} %{MONTH} %{TIME}",
+                    "REDISTIMESTAMP2": "%{MONTHDAY} %{MONTH} %{YEAR} %{TIME}"
                 }
             }
         },
@@ -57,6 +59,7 @@
                 "field": "redis.log.timestamp",
                 "target_field": "@timestamp",
                 "formats": [
+                    "dd MMM YYYY H:m:s.SSS",
                     "dd MMM H:m:s.SSS",
                     "dd MMM H:m:s",
                     "UNIX"

filebeat/module/redis/log/test/redis-5.0.3.log

@@ -0,0 +1 @@
+26571:M 27 Dec 2018 11:19:18.874 * Synchronization with replica 10.114.208.18:6023 succeeded

filebeat/module/redis/log/test/redis-5.0.3.log-expected.json

@@ -0,0 +1,14 @@
+[
+    {
+        "ecs.version": "1.0.0-beta2",
+        "event.dataset": "redis.log",
+        "event.module": "redis",
+        "fileset.name": "log",
+        "input.type": "log",
+        "log.level": "notice",
+        "log.offset": 0,
+        "message": "Synchronization with replica 10.114.208.18:6023 succeeded",
+        "process.pid": 26571,
+        "redis.log.role": "master"
+    }
+]