ElasticSearch 7.8 date and time format issue: unable to store date in MMM-dd-yyyy HH:mm:ss format . Was woking in 6.7.1

Elastic Stack Elasticsearch
1

[2020-08-10T14:30:58,866][WARN ][logstash.outputs.elasticsearch][main] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"metrics", :routing=>nil, :_type=>"_doc"}, #LogStash::Event:0x37d9caae], :response=>{"index"=>{"_index"=>"metrics-20200803", "_type"=>"_doc", "_id"=>"P5Sj2XMBruMyh45v0qce", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [metric_date] of type [date] in document with id 'P5Sj2XMBruMyh45v0qce'. Preview of field's value: 'AUG-10-2020 04:00:00'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"failed to parse date field [AUG-10-2020 04:00:00] with format [MMM-dd-yyyy||MMM-dd-yyyy HH:mm:ss]", "caused_by"=>{"type"=>"date_time_parse_exception", "reason"=>"Failed to parse with all enclosed parsers"}}}}}}

2

That error message is from elasticsearch. You might get a better response if you move this to the elasticsearch forum.

3

Below is the index .
PUT metrics-20200403
{
"settings": {
"index": {
"number_of_shards": "3",
"number_of_replicas": "2"
}
},
"mappings": {
"doc": {
"properties": {
"metric_date": { "type": "date", "format": "MMM-dd-yyyy||MMM-dd-yyyy HH:mm:ss" }
}
}
}
}

4

While Elasticsearch < 7 uses joda time for parsing, Elasticsearch >= 7 uses java time. There are some subtle differences in parsing. In this examples, the month being all caps seems to be the problem. Trying this with Aug instead of AUG works for me.

Feel free to open a github issue explaining the different behaviour between ES 6 and 7.

Thanks!

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.