Date Issue - Invalid format … malformed

Elastic Stack Elasticsearch
1

Hi everyone,

I've created a template index, looks something like that:

{
    "template" : "te*",
    "mappings" : {
        "msg" : {
            "date : { "type" : "date, "format" : "date_optional_time"}
            "contetnt":{"type" : "string", "index" : "not-analyzed"}
        }
    }
}

The date I'm inputting with the help of logstash is in this form: MM/dd/yyyy (for example, 04/06/2016), but I keep getting an error saying:
Invalid format: \"04/26/2016"\ is malformed \"26/2016"\

I've also tried to use other things in the mapping, for example:
"format" : "MM-dd-yyyy"
"format" : "MM/dd/yyyy"
And I keep getting the same error.

Do you have a solution for me?

Thanks.

EDIT:
I'm using ES 2.1

2

Not sure what your exact problem is but remember that:

  • you have to remove existing index if you want the new mapping to be applied
  • you might have to remove the template as well (unsure for this one)

Check your mapping after you get this error. It could give you a clue.

Finally, date optional time is day/month/year IIRC.

3

Hi, thanks for the response.

I did remove both the index and template after every change I made.

Thanks for clarifying the -date-optional-time format, do you know what I should use for the date I have in my input?

Thanks.

4

I think that what you proposed should work: "format" : "MM/dd/yyyy"

5

But it doesn't work, still gives me the same error.

6

What is the full error you are getting?

7

Here is the error from the elasticsearch log:

[2016-04-26 17:35:13,534][DEBUG][action.bulk][Ironclad][template-msg][3] failed to execute bulk item (index) index {template-msg][Content Modification Time][AVTYJTLqXmB4kBUtb7CA],source[{"message":"04/26/2016, Happy Birthday", "@version":"1", "@timestamp":"2016-04-27T05:35:48.294Z","beat":{"hostname":"comp","name":"comp"},"count":1,"fields":null,"input_type":"log","offset":614842169,"date":"04/26/2016", "msg":"Happy Birthday"}]}
MapperParsingException[failed to parse [date]]; nested: IllegalArgumentException[Invalid format: "26/04/2016" is malformed at "/14/2009"];
8

What is the mapping for:

GET template-msg/_mapping