Even though the datetime field is parsed properly by logstash pipeline, every document in elasticsearch has
"tags": [
"_dateparsefailure"
],
So wondering why the tags field is getting populated with _dateparsefailure
Even though the datetime field is parsed properly by logstash pipeline, every document in elasticsearch has
"tags": [
"_dateparsefailure"
],
So wondering why the tags field is getting populated with _dateparsefailure
Perhaps you have an extra file with an invalid date filter in /etc/logstash/conf.d (or wherever you keep your config files)? If you increase the loglevel Logstash will tell you exactly what configuration it loads. Make sure it's what you expect.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.