Date field is not Parsing

[Muhammed_Ashique]

Hello Team,

i have some data carrying date and this data is tagged with date data type. but sometime this filed is carrying empty body (without Date String) How can i parse for both conditions ? In the Time of Date is in body and without Date as well.

I tried to do convert data type from logstash level as per below . but still not parsing.

filter {
mutate {
convert => ["run_end_datetime","string"]
convert => ["run_start_datetime","string"]
convert => ["[stages][stage_log_datetime]","string"]
}
}

[aaron-nimocks]

The date format in the error is taking about the field's mapping within the index. You sent an empty field to Elastic and then it looked at the mapping and said that it doesn't fit so sent an error back to Logstash saying it can't index it because the Elastic mapping wants a date and you sent an empty field.

It really depends on what you want to use this field for to determine what to do. Some people just drop the field and don't index it because it's blank. Some people add ignore_malformed to the mapping so it will save regardless of format (could give unexpected results).

[Muhammed_Ashique]

I could not make drop. if i drop it is working. i need to use malformed. is it need to enable mapping for each fields ?

[aaron-nimocks]

The link in my above post will show you an example. You just need to update the mapping in your index for that specific field.