Dateparsefailure reason not known


(Raja Gopal) #1

I am running logstash 5 on rhel 6. I am trying to get xml data as input and format it through xml filter plugin. I store the output into a target field and i try to parse a UNIX type date in one of the fields inside the target array. But the result says _dateparsefailure and the reason is not known.
i will paste the config file here

            xml {
                    store_xml => true
                    source => message
                    target => parsed_message
            }
            mutate {
                    #convert => {"[parsed_message][LastChangedAt]" => "integer"}
            }
            date {
                    match => [ "[parsed_message][LastChangedAt]","UNIX" ]
                    target => "last_changed_timestamp"
            }

and the input i am giving is

Could someone help me


(Magnus Bäck) #2

If you format your XML as preformatted text it'll actually come through. Hint: Use the preview pane before posting.

Seeing an example event produced by Logstash would also be helpful.


(Raja Gopal) #3

<LastChangedAt><![CDATA[1505469213]]></LastChangedAt>


(Magnus Bäck) #4

Seeing an example event produced by Logstash would also be helpful.


(Raja Gopal) #5

What happens is the output comes like "LastChangedAt":["1505469213"] and logstash date filter is not working on this array value. If i just give "LastChangedAt": "1505469213", it is working fine.


(Magnus Bäck) #6

If it's an array you need to address the field accordingly, i.e. with [parsed_message][LastChangedAt][0] instead of [parsed_message][LastChangedAt].


(Raja Gopal) #7

Thanks magnusbaeck


(Raja Gopal) #8

I also used force_array => false in xml filter to make it more easier


(system) #9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.