This site helps with the date/time formats used: Joda-Time DateTimeFormat API documentation This is a useful site for debugging grok expressions: Grok Debugger — grokdebug.herokuapp.com (no longer online)