I have JDBC collecting from a database and then I'm feeding one of the fields to date to store it in timestamp. However I ran into an issue and found a workaround. Wondering if there might be a bug in JDBC input?
Basically the field "eventdt" is coming from the database. I use a date filter:
date { match => [ "eventdt", "ISO8601" ] }
This results in an error:
Failed parsing date from field", :field=>"eventdt", :value=>"2016-08-29T14:33:55.707Z", :exception=>"cannot convert instance of class org.jruby.RubyObject to class java.lang.String", :config_parsers=>"ISO8601", :config_locale=>"default=en_US"
I got around this issue by copying the field into metadata and parsing the metadata field instead.
mutate { add_field => [ "[@metadata][datehold]", "%{eventdt}"] }
date { match => [ "[@metadata][datehold]", "ISO8601" ] }
Perhaps there is something special that JDBC input is doing with returned fields leaving them as objects or lacking the to_s method or some such? Not a ruby expert here by any stretch of the imagination but thought I should report this.