Date Format Error with Full ISO Date

Elastic Stack Logstash
1

From logstash I'm getting (removed extraneous info) :

:timestamp=>"2016-04-12T12:14:08.428000-0500"
:message=>"Failed action. "
"reason"=>"Invalid format: "2016-04-12T12:14:04.7872034-05:00" is malformed at "-04-12T12:14:04.7872034-05:00"

I have control over the date and made the logger output an ISO date.
In my mapping I've tried "date_optional_time", "date_time" and several others and just get the aforementioned error.

What is the correct format when my document contains:
"timestamp": "2016-04-12T12:10:42.5726374-05:00" ?

2

The %{TIMESTAMP_ISO8601} grok pattern matches that, is it what you are using?

3

Actually I don't have that problem because it was simpler to just output the Json directly. I'm just reading with codec => "json". I removed the dashes from my output and got "format": "yyyyMMdd'T'HHmmss.SSSZ" to work. Is there no predefined date format that uses dashes and the offset time?

4

Yes, the one I mentioned;
TIMESTAMP_ISO8601 %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?

5

Is that the Elasticsearch mapping format parameter - "TIMESTAMP_ISO8601"?

6

No, this is a Logstash grok pattern.

7

What is the equivalent Elasticsearch constant? (Or, can you only use that format by specifying it as a format string?)