CODEWITHSUNDEEP
dateelasticsearchlogstash
Bob Willem
Bob Willem

Reputation: 59

Elasticsearch failed to parse [timestamp]

I know there are 30 of the same questions out there, but im not able to fix my issue with one of the answers. I got my index working for 7 days then I decided to remove the data with: 

DELETE csv

Because I did upload the same date over and over to test. After this I tryed to upload the data again so I only got one copy of it. I did not change anything in my .csv files that im uploading.

But I got the error message:

[2017-11-29T14:23:44,345][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"csv", :_type=>"csv", :_routing=>nil}, 2017-10-01T04:13:19.000Z DESKTOP-*** **.0.0.201,Fred Orr ,Fred_Orr@**.s**m,2017-10-01;06:13:19,** Story: This Tiny Pill Changes Everythi], :response=>{"index"=>{"_index"=>"csv", "_type"=>"csv", "_id"=>"*****", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [timestamp]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"2017-10-01;06:13:19\" is malformed at \";06:13:19\""}}}}}

In logstash I got the following configuration:

date {
    match => ["timestamp", "YYYY-MM-dd;HH:mm:ss"]
    target => "@timestamp"
   }

My date in the csv file is: 2017-10-01;06:13:19 And I try to match it against 2017-10-01;06:13:19? But it fails on the ;06:13:19 part. What is going wrong? I tryed to replace the ; with - or a space but nothing did work. so:

2017-10-01 06:13:19
2017-10-01-06:13:19

But I keep getting the error with the last part of the time.

Mapping:

"properties": {
          "@timestamp": {
            "type": "date"
          },

I dont understand what is wrong? It worked before I deleted the inde

Upvotes: 0

Views: 819

Answers (1)

Val
Val

Reputation: 217304

For non-formatting syntax, you’ll need to put single-quote characters around the value. Try this instead:

date {
    match => ["timestamp", "YYYY-MM-dd';'HH:mm:ss"]
    target => "@timestamp"
}

Upvotes: 2

Related Questions