I am getting the following warning which is clogging up my logs. Would anyone know what the issue might be please?
[2019-09-11T11:43:42,204][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"operational-2019.09.11", :_type=>"_doc", :routing=>nil}, #<LogStash::Event:0x1540184>], :response=>{"index"=>{"_index"=>"operational-2019.09.11", "_type"=>"_doc", "_id"=>"f_MiIG0BNgglah4k6i5u", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [DEPARTUREDATE] of type [date] in document with id 'f_MiIG0BNgglah4k6i5u'. Preview of field's value: '1900-01-01 00:00:00'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"failed to parse date field [1900-01-01 00:00:00] with format [strict_date_optional_time||epoch_millis]", "caused_by"=>{"type"=>"date_time_parse_exception", "reason"=>"Failed to parse with all enclosed parsers"}}}}}}
elasticsearch stores dates as the number of milliseconds since the epoch. I don't think that number can be negative, so it cannot store dates prior to 1970.
I changed the date to be hard coded to '1970-01-01 00:00:00' and am still getting this output. "reason"=>"failed to parse date field [1970-01-01 00:00:00] with format [strict_date_optional_time||epoch_millis]", "caused_by"=>{"type"=>"date_time_parse_exception", "reason"=>"Failed to parse with all enclosed parsers"}}}}}}
Could you help please? I am at a loss as to what is going wrong.
I finally managed to solve this. My hard coded date was simply missing the "T" in the middle of the date and time so it should have been "1970-01-01T00:00:00" instead of "1970-01-01 00:00:00".
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.