Accepted Date datatype for a field

Elastic Stack Elasticsearch
1

Hi guys,

I'm trying to automatically import files into Kibana using logstash and its schedule parameter
Nothing so tricky so far but I'm getting errors about the date format
I'm talking here about files containing billion lines (so very complicated to amend them before the logstash process)
I was wondering if Elastic can handle the format "2017-06-01 23:38:14.904 UTC" or if there is a way to modify this date during the logstash process to the "2017-06-01T23:38:14Z" format

Thanks for your help

2

Here is an example:

DELETE test 
PUT test 
{
  "mappings": {
    "properties": {
      "date": {
        "type": "date",
        "format": "y-M-d H:m:s.SSS z"
      }
    }
  }
}
PUT test/_doc/1
{
  "date": "2017-06-01 23:38: 14.904 UTC"
}
3

Hi there !
Lovely idea,
So I should pre create my index first with the mapping I want and then start inserting data with logstash ? Is that correct ?

4

Correct.

5

Thanks. Let me try it out and I'll get back to you or close it if solved

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.