"_dateparsefailure" Logstash 6.2.1

Even though the datetime field is parsed properly by logstash pipeline, every document in elasticsearch has
"tags": [
"_dateparsefailure"
],

So wondering why the tags field is getting populated with _dateparsefailure

Perhaps you have an extra file with an invalid date filter in /etc/logstash/conf.d (or wherever you keep your config files)? If you increase the loglevel Logstash will tell you exactly what configuration it loads. Make sure it's what you expect.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.