Regex Fails when space is removed in grok debugger

Question

I'm trying to extract date from a log file entry:

 ......
 Date is:2015-06-09
 ........

using grok debugger for logstash.

The regex I'm using is (?<=Date is:)[0-9\-]*\s? This regex works on regex101 but there aren't any matches in grok debugger.

Interestingly, if I add a space after : in both regex and file entry, the grok debugger gives correct results.

Answer 1

You could try:

((?<=Date is:)[\d\-]+\s?)|((?<=Date is: )[\d\-]+\s?)

First I added + instead of * as there is at least one date. One side of the regex checks for a Date is: with no space following the colon, the other side has a space after the colon then the date.