Elastic SIEM "Data Fetch Failure Invalid time value"

Elastic Security SIEM
1

Hello guys,
i hope you are doing well,
so i'm facing a problem on the elastic siem app after parsing my logs and migrating them to ecs by logstash.
the problem is the following error on the host/ event view :
Data Fetch Failure
Invalid time value
but not on all my indexes just one of them i tried to rebuild timestamps but i still have this error.
if just someone could tell me the source of this one

image
image539×539 27.5 KB

thanks in the advance

2

We are not all guys here :slight_smile:
Make sure all indexes used by SIEM app all have @timestamp field of type date

Under Stack Management >> Advanced Setting

image
image1097×116 13.6 KB

1 Like
3

Hi Yassine,
thanks but the thing is all my indices have type date for the @timestamp field (same mapping)

4

Can you post an example? maybe it's a format problem?

5

Hi borna
Problem resolved.
it was an unstructured event.start format
Thanks

1 Like
6

Thanks for posting that your problem was solved. I really :heart: the forums because of all the users always post their solution and what solved their problems for others to see.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.