Daily index rotation bug

Elastic Stack Logstash
1

Hi,

Every now and then a few documents (less than 1% of total logs) get placed into a daily index where the 20 in 2018 is replaced by 00.

For example,

logstash-6.4.3-0018.12.08

Has anyone encountered this? Seems like a bug somewhere, since all other docs get placed fine.

Best, Justin

2

I'm guessing that you are including a sprintf statement that relies on the value of @timestamp in your declaration of which index to insert docs into (e.g., index => "logstash-6.4.3-%{+yyyy.MM.dd}").

  • what does the value of @timestamp indicate?
  • If this is also showing years far in the past, how are you populating @timestamp (likely a date filter)?
2 Likes
3

Oh nice, good call. There's a date filter on nginx logs, and for these lines the date string is something like 18-12-08T01:34:06+00:00.

Thanks @yaauie!

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.