logstash/logstash — pull request #886 by tjrobinson (2013-12-18 14:58:24+00:00)
Title: Fix problem in MONTHNUM and add DATESTAMP_EVENTLOG pattern

Whilst trying to get Windows Event Log data into logstash I had some problems with the the timestamp format Windows uses.

Taking an example value (the TimeGenerated field provided by the eventlog input):

```
20131218141650.687853-000
```

And using:

```
%{YEAR}%{MONTHNUM}%{MONTHDAY}%{HOUR}%{MINUTE}%{SECOND}
```

I get a %{MONTHNUM} value of 1, but it should be 12. This is because the MONTHNUM pattern allows for single digit month values. I created a new pattern which removes this flexibility:

```
MONTHNUM2 (?:0[1-9]|1[0-2])
```

This, along with the new pattern below works as I would expect:

```
DATESTAMP_EVENTLOG %{YEAR}%{MONTHNUM2}%{MONTHDAY}%{HOUR}%{MINUTE}%{SECOND}
```

I'm sure there's a better way of implementing this but I think this is a genuine problem.