Could not index event to Elasticsearch. Logstash date filter

Elastic Stack Logstash
1

Hello,

I am constantly getting _dateparsefailure tag in Logstash output and because I am not using Time Filter in Index Patterns, I am getting an error : Could not index event to Elasticsearch. Preview of field's value: '2020-02-10 13:38:05.034'","reason"=>"failed to parse date field [2020-02-10 13:38:05.034] with format [strict_date_optional_time||epoch_millis]"

My date filter in logstash seems ok :

date {
    match => [ "log_date", "yyyy-MM-dd hh:mm:ss.SSS" ]
    target => "log_date"
    timezone => ['Europe/Warsaw']
 }

For this specific value, with this date filter Logstash is throwing exceptions and my data is not properly indexed in ElasticSearch
I need help with this problem, because date filter looks ok, and it's still not working.

2

Hi there,

what about

date {
  match => [ "log_date", "YYYY-MM-dd HH:mm:ss.SSS" ]
  target => "log_date"
  timezone => ['Europe/Warsaw']
}
3

hh is the hour of the half day, so it can be from 1 to 12. 13 is not valid. Use HH instead.

4

Thank you very much :slight_smile: That explains why is wasn't working after 12:00

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.