AWS AmazonCloudWatch documentation change
Summary
Updated Grok processor documentation with expanded pattern limits, added structure explanation, new examples, and enhanced pattern tables. Modified processor configurations with syntax corrections and additional capabilities in string mutation processors.
Security assessment
Changes focus on improving documentation clarity, expanding pattern limits from 5 to 20 grok patterns, adding JSON path support via dotted notation, and enhancing regex capabilities. No concrete evidence of addressing security vulnerabilities or weaknesses. The note about disallowing custom Grok patterns is a security control but was likely existing policy rather than a new security fix.
Diff
diff --git a/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.md b/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.md index 936e7836a..65553ba46 100644 --- a//AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.md +++ b//AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.md @@ -23 +23 @@ This section contains information about each processor that you can use in a log - * [Example 2](./CloudWatch-Logs-Transformation-Processors.html#Grok-Example2) + * [Example 2: Use grok in combination with parseJSON to extract fields from a JSON log event](./CloudWatch-Logs-Transformation-Processors.html#Grok-Example3) @@ -25 +25 @@ This section contains information about each processor that you can use in a log - * [Example 3: Use grok in combination with parseJSON to extract fields from a JSON log event](./CloudWatch-Logs-Transformation-Processors.html#Grok-Example3) + * [Example 3: Grok pattern with dotted annotation in FIELD_NAME](./CloudWatch-Logs-Transformation-Processors.html#Grok-Example4) @@ -115,0 +116 @@ Then if we have this **parseJSON** processor: + { @@ -118,0 +120 @@ Then if we have this **parseJSON** processor: + } @@ -134 +136 @@ The transformed log event would be the following. -Use the grok processor to use pattern matching to parse and structure unstructured data. This processor can also extract fields from log messages. +Use the grok processor to parse and structure unstructured data using pattern matching. This processor can also extract fields from log messages. @@ -136,4 +138,24 @@ Use the grok processor to use pattern matching to parse and structure unstructur -Field | Description | Required? | Default | Limits ----|---|---|---|--- -source | Path to the field in the log event to apply grok matching to | No | `@message` | Maximum length: 128 Maximum nested key depth: 3 -match | The grok pattern to match against the log event. The supported grok patterns are listed at the end of this section. | Yes | | Maximum length: 128 Maximum of 5 grok patterns. grok patterns won't support type conversions. For common log format patterns (APACHE_ACCESS_LOG, NGINX_ACCESS_LOG, SYSLOG5424,) only GREEDYDATA or DATA patterns are supported to be included after the common log pattern. +Field | Description | Required? | Default | Limits | Notes +---|---|---|---|---|--- +source | Path of the field to apply Grok matching on | No | `@message` | Maximum length: 128 Maximum nested key depth: 3 +match | The grok pattern to match against the log event | Yes | | Maximum length: 512 Maximum grok patterns: 20 Some grok pattern types have individual usage limits. Any combination of the following patterns can be used as many as five times: {URI, URIPARAM, URIPATHPARAM, SPACE, DATA, GREEDYDATA, GREEDYDATA_MULTILINE} Grok patterns don't support type conversions. For common log format patterns (APACHE_ACCESS_LOG, NGINX_ACCESS_LOG, SYSLOG5424), only DATA, GREEDYDATA, or GREEDYDATA_MULTILINE patterns are supported to be included after the common log pattern. | See all supported Grok patterns + +**Structure of a Grok Pattern** + +This is the supported grok pattern structure: + + + %{PATTERN_NAME:FIELD_NAME} + + * **PATTERN_NAME** : Refers to a pre-defined regular expression for matching a specific type of data. Only predefined grok patterns from the [supported grok patterns list](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#Grok-Patterns) are supported. Creating custom patterns is not allowed. + + * **FIELD_NAME** : Assigns a name to the extracted value. `FIELD_NAME` is optional, but if you don't specify this value then the extracted data will be dropped from the transformed log event. If `FIELD_NAME` uses dotted notation (e.g., "parent.child"), it is considered as a JSON path. + + * **Type Conversion** : Explicit type conversions are not be supported. Use [TypeConverter processor](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-typeConverter) to convert the datatype of any value extracted by grok. + + + + +To create more complex matching expressions, you can combine several grok patterns. As many as 20 grok patterns can be combined to match a log event. For example, this combination of patterns `%{NUMBER:timestamp} [%{NUMBER:db} %{IP:client_ip}:%{NUMBER:client_port}] %{GREEDYDATA:data}` can be used to extract fields from a Redis slow log entry like this: + +`1629860738.123456 [0 127.0.0.1:6379] "SET" "key1" "value1"` @@ -153,0 +176 @@ Transformer used: + { @@ -170,2 +192,0 @@ Output: -##### Example 2 - @@ -180,0 +202 @@ Transformer used: + { @@ -196 +218 @@ Output: -##### Example 3: Use grok in combination with parseJSON to extract fields from a JSON log event +##### Example 2: Use grok in combination with parseJSON to extract fields from a JSON log event @@ -211,2 +232,0 @@ Transformer used: - "parseJSON": {}, - "grok": @@ -213,0 +234,4 @@ Transformer used: + "parseJSON": {} + }, + { + "grok": { @@ -231,0 +256,35 @@ Output: +##### Example 3: Grok pattern with dotted annotation in FIELD_NAME + +Sample log: + + + 192.168.1.1 GET /index.html?param=value 200 1234 + +Transformer used: + + + [ + { + "grok": { + "match": "%{IP:client.ip} %{WORD:method} %{URIPATHPARAM:request.uri} %{NUMBER:response.status} %{NUMBER:response.bytes}" + } + } + ] + +Output: + + + { + "client": { + "ip": "192.168.1.1" + }, + "method": "GET", + "request": { + "uri": "/index.html?param=value" + }, + "response": { + "status": "200", + "bytes": "1234" + } + } + @@ -238,16 +297,17 @@ The following tables list the patterns that are supported by the `grok` processo -Pattern | Example | Description ----|---|--- -USERNAME or USER | Input: `user123.name-TEST` Pattern: `%{USERNAME:name}` Output: `{"name": "user123.name-TEST"}` | Matches one or more characters that can include lowercase letters (a-z), uppercase letters (A-Z), digits (0-9), dots (.), underscores (_), or hyphens (-) -INT | Input: `-456` Pattern: `%{INT:num}` Output: `{"num": "-456"}` | Matches an optional plus or minus sign followed by one or more digits. -BASE10NUM | Input: `-0.67` Pattern: `%{BASE10NUM:num}` Output: `{"num": "-0.67"}` | Matches an integer or a floating-point number with optional sign and decimal point. -BASE16NUM | Input: `+0xA1B2` Pattern: `%{BASE16NUM:num}` Output: `{"num": "+0xA1B2"}` | Matches decimal and hexadecimal numbers with an optional sign (+ or -) and an optional 0x prefix. -POSINT | Input: `123` Pattern: `%{POSINT:num}` Output: `{"num": "123"}` | Matches whole positive integers without leading zeros, consisting of one or more digits (1-9 followed by 0-9). -NONNEGINT | Input: `008` Pattern: `%{NONNEGINT:num}` Output: `{"num": "008"}` | Matches any whole numbers (consisting of one or more digits 0-9) including zero and numbers with leading zeros.. -WORD | Input: `user_123` Pattern: `%{WORD:user}` Output: `{"user": "user_123"}` | Matches whole words composed of one or more word characters (\w), including letters, digits, and underscores. -NOTSPACE | Input: `hello_world123` Pattern: `%{NOTSPACE:msg}` Output: `{"msg": "hello_world123"}` | Matches one or more non-whitespace characters. -SPACE | Input: `" "` Pattern: `%{SPACE:extra}` Output: `{"extra": " "}` | Matches zero or more whitespace characters. -DATA | Input: `abc def` Pattern: `%{DATA:data}` Output: `{"data": "abc def"}` | Matches any character (except newline) zero or more times, non-greedy. -GREEDYDATA | Input: `abc def` Pattern: `%{GREEDYDATA:data}` Output: `{"data": "abc def"}` | Matches any character (except newline) zero or more times, greedy. -QUOTEDSTRING | Input: `"Hello, world!"` Pattern: `%{QUOTEDSTRING:msg}` Output: `{"msg": "Hello, world!"}` | Matches quoted strings (single or double quotes) with escaped characters. -UUID | Input: `550e8400-e29b-41d4-a716-446655440000` Pattern: `%{UUID:id}` Output: `{"id": "550e8400-e29b-41d4-a716-446655440000"}` | Matches a standard UUID format: 8 hexadecimal characters, followed by three groups of 4 hexadecimal characters, and ending with 12 hexadecimal characters, all separated by hyphens. -URN | Input: `urn:isbn:0451450523` Pattern: `%{URN:urn}` Output: `{"urn": "urn:isbn:0451450523"}` | Matches Uniform Resource Name (URN) syntax. +Grok Pattern | Description | Maximum pattern limit | Example +---|---|---|--- +USERNAME or USER | Matches one or more characters that can include lowercase letters (a-z), uppercase letters (A-Z), digits (0-9), dots (.), underscores (_), or hyphens (-) | 20 | Input: `user123.name-TEST` Pattern: `%{USERNAME:name}` Output: `{"name": "user123.name-TEST"}` +INT | Matches an optional plus or minus sign followed by one or more digits. | 20 | Input: `-456` Pattern: `%{INT:num}` Output: `{"num": "-456"}` +BASE10NUM | Matches an integer or a floating-point number with optional sign and decimal point | 20 | Input: `-0.67` Pattern: `%{BASE10NUM:num}` Output: `{"num": "-0.67"}` +BASE16NUM | Matches decimal and hexadecimal numbers with an optional sign (+ or -) and an optional 0x prefix | 20 | Input: `+0xA1B2` Pattern: `%{BASE16NUM:num}` Output: `{"num": "+0xA1B2"}` +POSINT | Matches whole positive integers without leading zeros, consisting of one or more digits (1-9 followed by 0-9) | 20 | Input: `123` Pattern: `%{POSINT:num}` Output: `{"num": "123"}` +NONNEGINT | Matches any whole numbers (consisting of one or more digits 0-9) including zero and numbers with leading zeros. | 20 | Input: `007` Pattern: `%{NONNEGINT:num}` Output: `{"num": "007"}` +WORD | Matches whole words composed of one or more word characters (\w), including letters, digits, and underscores | 20 | Input: `user_123` Pattern: `%{WORD:user}` Output: `{"user": "user_123"}` +NOTSPACE | Matches one or more non-whitespace characters. | 5 | Input: `hello_world123` Pattern: `%{NOTSPACE:msg}` Output: `{"msg": "hello_world123"}` +SPACE | Matches zero or more whitespace characters. | 5 | Input: `" "` Pattern: `%{SPACE:extra}` Output: `{"extra": " "}` +DATA | Matches any character (except newline) zero or more times, non-greedy. | 5 | Input: `abc def ghi` Pattern: `%{DATA:x} %{DATA:y}` Output: `{"x": "abc", "y": "def ghi"}` +GREEDYDATA | Matches any character (except newline) zero or more times, greedy. | 5 | Input: `abc def ghi` Pattern: `%{GREEDYDATA:x} %{GREEDYDATA:y}` Output: `{"x": "abc def", "y": "ghi"}` +GREEDYDATA_MULTILINE | Matches any character (including newline) zero or more times, greedy. | 1 | Input: `abc` `def` `ghi` Pattern: `%{GREEDYDATA_MULTILINE:data}` Output: `{"data": "abc\ndef\nghi"}` +QUOTEDSTRING | Matches quoted strings (single or double quotes) with escaped characters. | 20 | Input: `"Hello, world!"` Pattern: `%{QUOTEDSTRING:msg}` Output: `{"msg": "Hello, world!"}` +UUID | Matches a standard UUID format: 8 hexadecimal characters, followed by three groups of 4 hexadecimal characters, and ending with 12 hexadecimal characters, all separated by hyphens. | 20 | Input: `550e8400-e29b-41d4-a716-446655440000` Pattern: `%{UUID:id}` Output: `{"id": "550e8400-e29b-41d4-a716-446655440000"}` +URN | Matches URN (Uniform Resource Name) syntax. | 20 | Input: `urn:isbn:0451450523` Pattern: `%{URN:urn}` Output: `{"urn": "urn:isbn:0451450523"}` @@ -257,3 +317,3 @@ URN | Input: `urn:isbn:0451450523` Pattern: `%{URN:urn}` Output: `{"urn": "urn: -Pattern | Example | Description ----|---|--- -ARN | Input: `arn:aws:iam:us-east-1:123456789012:user/johndoe` Pattern: `%{ARN:arn}` Output: `{"arn": "arn:aws:iam:us-east-1:123456789012:user/johndoe"}` | Matches AWS Amazon Resource Names (ARNs), capturing the partition (`aws`, `aws-cn`, or `aws-us-gov`), service, Region, account ID, and up to 5 hierarchical resource identifiers separated by slashes. It will not match ARNs that are missing information between colons. +Pattern | Description | Maximum pattern limit | Example +---|---|---|--- +ARN | Matches AWS Amazon Resource Names (ARNs), capturing the partition (`aws`, `aws-cn`, or `aws-us-gov`), service, Region, account ID, and up to 5 hierarchical resource identifiers separated by slashes. It will not match ARNs that are missing information between colons. | 5 | Input: `arn:aws:iam:us-east-1:123456789012:user/johndoe` Pattern: `%{ARN:arn}` Output: `{"arn": "arn:aws:iam:us-east-1:123456789012:user/johndoe"}` @@ -263,13 +323,13 @@ ARN | Input: `arn:aws:iam:us-east-1:123456789012:user/johndoe` Pattern: `%{ARN: -Pattern | Example | Description ----|---|--- -CISCOMAC | Input: `0123.4567.89AB` Pattern: `%{CISCOMAC:MacAddress}` Output: `{"MacAddress": "0123.4567.89AB"}` | Matches a MAC address in 4-4-4 hexadecimal format. -WINDOWSMAC | Input: `01-23-45-67-89-AB` Pattern: `%{WINDOWSMAC:MacAddress}` Output: `{"MacAddress": "01-23-45-67-89-AB"}` | Matches a MAC address in hexadecimal format with hyphens. -COMMONMAC | Input: `01:23:45:67:89:AB` Pattern: `%{COMMONMAC:MacAddress}` Output: `{"MacAddress": "01:23:45:67:89:AB"}` | Matches a MAC address in hexadecimal format with colons. -MAC | Input: `01:23:45:67:89:AB` Pattern: `%{MAC:m1}` Output: `{"m1": "01:23:45:67:89:AB"}` | Matches any of the **CISCOMAC** , **WINDOWSMAC** , or **COMMONMAC** patterns. -IPV6 | Input: `2001:db8:3333:4444:5555:6666:7777:8888` Pattern: `%{IPV6:ip}` Output: `{"ip": "2001:db8:3333:4444:5555:6666:7777:8888"}` | Matches IPv6 addresses, including compressed forms and IPv4-mapped IPv6 addresses. -IPV4 | Input: `192.168.0.1` Pattern: `%{IPV4:ip}` Output: `{"ip": "192.168.0.1"}` | Matches IPv4 addresses. -IP | Input: `192.168.0.1` Pattern: `%{IP:ip}` Output: `{"ip": "192.168.0.1"}` | Matches either IPv6 addresses as supported by the **IPV6** pattern or IPv4 addresses as supported by the **IPV4** pattern. -HOSTNAME or HOST | Input: `server-01.internal-network.local` Pattern: `%{HOST:host}` Output: `{"host": "server-01.internal-network.local"}` | Matches domain names, including subdomains. -IPORHOST | Input: `2001:db8:3333:4444:5555:6666:7777:8888` Pattern: `%{IPORHOST:ip}` Output: `{"ip": "2001:db8:3333:4444:5555:6666:7777:8888"}` | Matches either a hostname as supported in the **HOSTNAME** pattern or an IP address as supported in the **IP** pattern. -HOSTPORT | Input: `192.168.0.1:8080` Pattern: `%{HOSTPORT:ip}` Output: `{"ip":"192.168.0.1:8080","PORT":"8080"}` | Matches an IP address or hostname as supported by the **IPORHOST** pattern followed by a colon and a port number, capturing the port as "PORT" in the output. -URIHOST | Input: `example.com:443 10.0.0.1` Pattern: `%{URIHOST:host} %{URIHOST:ip}` Output: `{"host":"example.com:443","port":"443","ip":"10.0.0.1"}` | Matches an IP address or hostname as supported by the **IPORHOST** pattern, optionally followed by a colon and a port number, capturing the port as "port" if present. +Grok Pattern | Description | Maximum pattern limit | Example +---|---|---|--- +CISCOMAC | Matches a MAC address in 4-4-4 hexadecimal format. | 20 | Input: `0123.4567.89AB` Pattern: `%{CISCOMAC:MacAddress}` Output: `{"MacAddress": "0123.4567.89AB"}` +WINDOWSMAC | Matches a MAC address in hexadecimal format with hyphens | 20 | Input: `01-23-45-67-89-AB` Pattern: `%{WINDOWSMAC:MacAddress}` Output: `{"MacAddress": "01-23-45-67-89-AB"}` +COMMONMAC | Matches a MAC address in hexadecimal format with colons. | 20 | Input: `01:23:45:67:89:AB` Pattern: `%{COMMONMAC:MacAddress}` Output: `{"MacAddress": "01:23:45:67:89:AB"}` +MAC | Matches one of CISCOMAC, WINDOWSMAC or COMMONMAC grok patterns | 20 | Input: `01:23:45:67:89:AB` Pattern: `%{MAC:m1}` Output: `{"m1":"01:23:45:67:89:AB"}` +IPV6 | Matches IPv6 addresses, including compressed forms and IPv4-mapped IPv6 addresses. | 5 | Input: `2001:db8:3333:4444:5555:6666:7777:8888` Pattern: `%{IPV6:ip}` Output: `{"ip": "2001:db8:3333:4444:5555:6666:7777:8888"}` +IPV4 | Matches an IPv4 address. | 20 | Input: `192.168.0.1` Pattern: `%{IPV4:ip}` Output: `{"ip": "192.168.0.1"}` +IP | Matches either IPv6 addresses as supported by %{IPv6} or IPv4 addresses as supported by %{IPv4} | 5 | Input: `192.168.0.1` Pattern: `%{IP:ip}` Output: `{"ip": "192.168.0.1"}` +HOSTNAME or HOST | Matches domain names, including subdomains | 5 | Input: `server-01.internal-network.local` Pattern: `%{HOST:host}` Output: `{"host": "server-01.internal-network.local"}` +IPORHOST | Matches either a hostname or an IP address | 5 | Input: `2001:db8:3333:4444:5555:6666:7777:8888` Pattern: `%{IPORHOST:ip}` Output: `{"ip": "2001:db8:3333:4444:5555:6666:7777:8888"}` +HOSTPORT | Matches an IP address or hostname as supported by %{IPORHOST} pattern followed by a colon and a port number, capturing the port as "PORT" in the output. | 5 | Input: `192.168.1.1:8080` Pattern: `%{HOSTPORT:ip}` Output: `{"ip":"192.168.1.1:8080","PORT":"8080"}` +URIHOST | Matches an IP address or hostname as supported by %{IPORHOST} pattern, optionally followed by a colon and a port number, capturing the port as "port" if present. | 5 | Input: `example.com:443 10.0.0.1` Pattern: `%{URIHOST:host} %{URIHOST:ip}` Output: `{"host":"example.com:443","port":"443","ip":"10.0.0.1"}` @@ -279,11 +339,11 @@ URIHOST | Input: `example.com:443 10.0.0.1` Pattern: `%{URIHOST:host} %{URIHOST -Pattern | Example | Description ----|---|--- -UNIXPATH | Input: `/search?q=regex` Pattern: `%{UNIXPATH:path}` Output: `{"path":"/search?q=regex"}` | Matches URL paths, potentially including query parameters. -WINPATH | Input: `C:\Users\John\Documents\file.txt` Pattern: `%{WINPATH:path}` Output: `{"path": "C:\\Users\\John\\Documents\\file.txt"}` | Matches Windows file paths. -PATH | Input: `/search?q=regex` Pattern: `%{PATH:path}` Output: `{"path":"/search?q=regex"}` | Matches either URL or Windows file paths. -TTY | Input: `/dev/tty1` Pattern: `%{TTY:path}` Output: `{"path":"/dev/tty1"}` | Matches Unix device paths for terminals and pseudo-terminals. -URIPROTO | Input: `web+transformer` Pattern: `%{URIPROTO:protocol}` Output: `{"protocol":"web+transformer"}` | Matches letters, optionally followed by a plus (+) character and additional letters or plus (+) characters. -URIPATH | Input: `/category/sub-category/product_name` Pattern: `%{URIPATH:path}` Output: `{"path":"/category/sub-category/product_name"}` | Matches the path component of a URI. -URIPARAM | Input: `?param1=value1¶m2=value2` Pattern: `%{URIPARAM:url}` Output: `{"url":"?param1=value1¶m2=value2"}` | Matches URL query parameters. -URIPATHPARAM | Input: `/category/sub-category/product?id=12345&color=red` Pattern: `%{URIPATHPARAM:path}` Output: `{"path":"/category/sub-category/product?id=12345&color=red"}` | Matches a URI path optionally followed by query parameters. -URI | Input: `https://user:[email protected]/path/to/resource?param1=value1¶m2=value2` Pattern: `%{URI:uri}` Output: `{"path":"https://user:[email protected]/path/to/resource?param1=value1¶m2=value2"}` | Matches a complete URI. +Grok Pattern | Description | Maximum pattern limit | Example +---|---|---|--- +UNIXPATH | Matches URL paths, potentially including query parameters. | 20 | Input: `/search?q=regex` Pattern: `%{UNIXPATH:path}` Output: `{"path":"/search?q=regex"}` +WINPATH | Matches Windows file paths. | 5 | Input: `C:\Users\John\Documents\file.txt` Pattern: `%{WINPATH:path}` Output: `{"path": "C:\\Users\\John\\Documents\\file.txt"}` +PATH | Matches either URL or Windows file paths | 5 | Input: `/search?q=regex` Pattern: `%{PATH:path}` Output: `{"path":"/search?q=regex"}` +TTY | Matches Unix device paths for terminals and pseudo-terminals. | 20 | Input: `/dev/tty1` Pattern: `%{TTY:path}` Output: `{"path":"/dev/tty1"}` +URIPROTO | Matches letters, optionally followed by a plus (+) character and additional letters or plus (+) characters | 20 | Input: `web+transformer` Pattern: `%{URIPROTO:protocol}` Output: `{"protocol":"web+transformer"}` +URIPATH | Matches the path component of a URI | 20 | Input: `/category/sub-category/product_name` Pattern: `%{URIPATH:path}` Output: `{"path":"/category/sub-category/product_name"}` +URIPARAM | Matches URL query parameters | 5 | Input: `?param1=value1¶m2=value2` Pattern: `%{URIPARAM:url}` Output: `{"url":"?param1=value1¶m2=value2"}` +URIPATHPARAM | Matches a URI path optionally followed by query parameters | 5 | Input: `/category/sub-category/product?id=12345&color=red` Pattern: `%{URIPATHPARAM:path}` Output: `{"path":"/category/sub-category/product?id=12345&color=red"}` +URI | Matches a complete URI | 5 | Input: `https://user:[email protected]/path/to/resource?param1=value1¶m2=value2` Pattern: `%{URI:uri}` Output: `{"path":"https://user:[email protected]/path/to/resource?param1=value1¶m2=value2"}` @@ -293,23 +353,24 @@ URI | Input: `https://user:[email protected]/path/to/resource?param1=value1& -Pattern | Example | Description ----|---|--- -MONTH | Input: `Jan` Pattern: `%{MONTH:month}` Output: `{"month":"Jan"}` Input: `January` Pattern: `%{MONTH:month}` Output: `{"month":"January"}` | Matches full or abbreviated month names in English as whole words. -MONTHNUM | Input: `5` Pattern: `%{MONTHNUM:month}` Output: `{"month":"5"}` Input: `05` Pattern: `%{MONTHNUM:month}` Output: `{"month":"05"}` | Matches month numbers from 1 to 12, with optional leading zero for single-digit months. -MONTHNUM2 | Input: `05` Pattern: `%{MONTHNUM2:month}` Output: `{"month":"05"}` | Matches two-digit month numbers from 01 to 12. -MONTHDAY | Input: `31` Pattern: `%{MONTHDAY:monthDay}` Output: `{"monthDay":"31"}` | Matches day of the month from 1 to 31, with optional leading zero. -YEAR | Input: `2024` Pattern: `%{YEAR:year}` Output: `{"year":"2024"}` Input: `24` Pattern: `%{YEAR:year}` Output: `{"year":"24"}` | Matches years in either two or four-digit formats. -DAY | Input: `Tuesday` Pattern: `%{DAY:day}` Output: `{"day":"Tuesday"}` | Matches full or abbreviated day names.