Could not index event to Elasticsearch. Illegal argument exception

[Erich_King]

Hi there.

I am getting the following warning which is clogging up my logs. Would anyone know what the issue might be please?

[2019-09-11T11:43:42,204][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"operational-2019.09.11", :_type=>"_doc", :routing=>nil}, #<LogStash::Event:0x1540184>], :response=>{"index"=>{"_index"=>"operational-2019.09.11", "_type"=>"_doc", "_id"=>"f_MiIG0BNgglah4k6i5u", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [DEPARTUREDATE] of type [date] in document with id 'f_MiIG0BNgglah4k6i5u'. Preview of field's value: '1900-01-01 00:00:00'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"failed to parse date field [1900-01-01 00:00:00] with format [strict_date_optional_time||epoch_millis]", "caused_by"=>{"type"=>"date_time_parse_exception", "reason"=>"Failed to parse with all enclosed parsers"}}}}}}

Thanks so much.

[Badger]

@Erich_King

failed to parse date field [1900-01-01 00:00:00]

elasticsearch stores dates as the number of milliseconds since the epoch. I don't think that number can be negative, so it cannot store dates prior to 1970.

[Erich_King]

Thanks a lot for this. I know it was a simple one. These dates are hard-coded. I will update to 1990. Should do the trick. Thanks again.

[Erich_King]

Hi Badger.

I changed the date to be hard coded to '1970-01-01 00:00:00' and am still getting this output. "reason"=>"failed to parse date field [1970-01-01 00:00:00] with format [strict_date_optional_time||epoch_millis]", "caused_by"=>{"type"=>"date_time_parse_exception", "reason"=>"Failed to parse with all enclosed parsers"}}}}}}

Could you help please? I am at a loss as to what is going wrong.

[Erich_King]

I finally managed to solve this. My hard coded date was simply missing the "T" in the middle of the date and time so it should have been "1970-01-01T00:00:00" instead of "1970-01-01 00:00:00".

Thanks for the help @Badger.