Elasticsearch 5.4 failing to ingest logs without "+0000" in timestamp

Elastic Stack Elasticsearch
1

I'm starting to transition from some old Elasticsearch servers (running v1.6) to a new cluster (running 5.4.1). As part of doing so, I've configured my existing Logstash servers (running logstash 1.5) to send logs to both old and new clusters using the http protocol. This is mostly working just fine with one exception - most of the logs have times like "2017-07-04T20:47:39,251+0000" in the raw log and index into both new and old ES clusters just fine. But some logs have times like "2017-07-04 20:51:43,214" in the raw log - missing the "+0000". These logs index into the OLD cluster just fine, but fail to get into the NEW cluster. The error log message saying that they've failed to get ingested gets ingested just fine - they look like :

{:timestamp=>"2017-07-04T21:04:36.927000+0000", :message=>"failed action with response of 400, dropping action: ["index", {:_id=>nil, :_index=>"test-2017.07.04", :_type=>"XXXXXXXX", :_routing=>nil}, #<LogStash::Event:0x78f67e77 @metadata_accessors=#<LogStash::Util::Accessors:0x1f94b385 @store={"retry_count"=>0}, @lut={}>, @cancelled=false, @data={"message"=>"2017-07-04 20:56:12,683 - XXXXXXXXXXXXXX", "@version"=>"1", "@timestamp"=>"2017-07-04T20:56:12.683Z", "file"=>"/var/log/XXXXXXXX.log", "host"=>"XXXXXXXX", "offset"=>"56170", "type"=>"XXXXXXXX", "time"=>"2017-07-04 20:56:12,683", "loglevel"=>"INFO", "msg"=>"XXXXXXXX", "facility"=>"XXXXXXXX", "received_at"=>"2017-07-04T20:56:14.473Z", "tags"=>["mutated", "date_changed"]}, @metadata={"retry_count"=>0}, @accessors=#<LogStash::Util::Accessors:0x2c51d543 @store={"message"=>"XXXXXXXX", "@version"=>"1", "@timestamp"=>"2017-07-04T20:56:12.683Z", "file"=>"/XXXXXXXX", "host"=>"XXXXXXXX", "offset"=>"56170", "type"=>"XXXXXXXX", "time"=>"2017-07-04 20:56:12,683", "loglevel"=>"INFO", ....

Any ideas what the problem might be? I can't easily change the format of these log messages.

2

In the mapping you can define multiple date formats.
That should help

3

Wonderful! The following appears to have worked:

PUT test-2017.07.04/_mapping/XXXXXXXXXX?update_all_types
{
"properties": {
"time": {
"type":"date",
"format": "yyyy-MM-dd HH:mm:ss,SSS||date_optional_time"
}
}
}

One followup question though : I've never figured out how to make changes like this into the permanent default across all (new) indices. Any pointers?

4

Use an index template in which you define the mappings or dynamic mappings you want

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.