Date parsing issue for ISO8601 in storing first line

Elastic Stack Logstash
1

We are reading the data from csv file and storing it on elasticsearch. Below is the filter used for date

date {
    match => [ "extractTimestamp", "ISO8601"]
    target => "extractTimestamp"
    tag_on_failure => ["extractDatetimefailure"]
}

extractTimestamp- 2024-05-27T18:46:49.089Z
Please refer the file data

2024-05-27T18:46:49.089Z        TEST1         PL      83              202405120150003821A1    2024-05-14T07:21:00.000Z        399.00          Closed  TEST     50      12345678
2024-05-27T18:46:49.089Z        TEST2         PL      83              202405120150003821A1    2024-05-14T07:21:00.000Z        399.00          Closed  TEST1     50      12345678

The issue is when first line inserts it throws dateparse exception. For rest of the logs there is no exception.
On daily basis for the first line log it is failing with dateparse.

Could you please help us in understanding the issue?

2

Data looks OK. It's not clear where is the issue.

Can you check what is an error by handling output:

output {
  if "extractDatetimefailure" in [tags] {
    file { path => "/path/error_%{+YYYY-MM-dd}.txt" }
   # you can use index as well instead of file
  }
... 
}

Do you have any specific settings in csv plugin/codec like skip_header or similar?

3

thanks @Rios for the quick response.
Will check and update.