Dateparsefailure reason not known

Elastic Stack Logstash
1

I am running logstash 5 on rhel 6. I am trying to get xml data as input and format it through xml filter plugin. I store the output into a target field and i try to parse a UNIX type date in one of the fields inside the target array. But the result says _dateparsefailure and the reason is not known.
i will paste the config file here

            xml {
                    store_xml => true
                    source => message
                    target => parsed_message
            }
            mutate {
                    #convert => {"[parsed_message][LastChangedAt]" => "integer"}
            }
            date {
                    match => [ "[parsed_message][LastChangedAt]","UNIX" ]
                    target => "last_changed_timestamp"
            }

and the input i am giving is

Could someone help me

2

If you format your XML as preformatted text it'll actually come through. Hint: Use the preview pane before posting.

Seeing an example event produced by Logstash would also be helpful.

3

<LastChangedAt><![CDATA[1505469213]]></LastChangedAt>

4

Seeing an example event produced by Logstash would also be helpful.

5

What happens is the output comes like "LastChangedAt":["1505469213"] and logstash date filter is not working on this array value. If i just give "LastChangedAt": "1505469213", it is working fine.

6

If it's an array you need to address the field accordingly, i.e. with [parsed_message][LastChangedAt][0] instead of [parsed_message][LastChangedAt].

7

Thanks magnusbaeck

8

I also used force_array => false in xml filter to make it more easier

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.