Beats setup.template date format only accepts string, url, or date

Elastic Stack Beats
1

In my filebeat configuration, I am trying to append a field of type date with a format specified.

setup.template:
  overwrite: false
  append_fields:
  - name: testfield
    type: date
    format: "dd/MMM/yyyy:HH:mm:ss Z"

However, I get the following error:

Exiting: unpacking template config fails: incorrect type configuration for field 'testfield': unexpected format 'dd/MMM/yyyy:HH:mm:ss Z' for field 'testfield', expected one of: string, url, date accessing 'setup.template.append_fields.0' (source:'filebeat.yml')

I am using Elasticsearch:8.2.0 and Filebeats:8.2.0.

According to the sourcecode, the accepted formatters only include string, url, and date, and doesn't allow for custom formatters. Why is this the specification?

In order to apply custom formatters, I will have to use component templates, but it would be ideal if it can be set in the filebeats config.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.