Hello.
I am new to Elasticsearch. i am using Fluentd, Elasticsearch, Kibana.
my Fluentd configuration :
<source>
type tail
path /var/log/access/assets.access/*
pos_file /var/log/access/assets.access/readlog.pos
read_from_head true
format multiline
format nginx
tag assets.access
time_format %d/%b/%Y:%H:%M:%S %z
keep_time_key true
</source>
<match assets.access>
type elasticsearch
host 192.168.1.32
port 9200
index_name assets.access
type_name access
flush_interval 10s
format json
</match>
and Elasticsearch Index mapping like this :
curl -XPOST 'elastic.local:9200/assets.access' -d '
{
"mappings":{
"assets.access":{
"properties":{
"time":{
"type":"date",
"format": "dd/MMM/yyyy:HH:mm:ss Z"
}
}
}
}
}'
Index mapping and fluentd configuration generated no error.
but in the process of inserting document to index, i got this error :
Suppressed: MapperParsingException[failed to parse [time]]; nested: IllegalArgumentException[Invalid format: "28/Mar/2016:15:03:49 +0900" is malformed at "/Mar/2016:15:03:49 +0900"];
In a different way,
i configure fluentd like this :
<source>
type tail
path /var/log/access/assets.access/*
pos_file /var/log/access/assets.access/readlog.pos
read_from_head true
format multiline
format nginx
tag sample
</source>
<filter **>
type record_transformer
<record>
date ${time}
</record>
</filter>
<match sample>
type record_reformer
output_tag assets.access
date ${time.strftime('%Y-%m-%d %H:%M:%S %z')}
</match>
<match assets.access>
type elasticsearch
host 192.168.1.32
port 9200
index_name assets.access
type_name access
flush_interval 10s
format json
</match>
and Elasticsearch Index mapping :
curl -XPOST 'elastic.local:9200/assets.access' -d '
{
"mappings":{
"assets.access":{
"properties":{
"date":{
"type":"date",
"format": "yyyy-MM-dd HH:mm:ss Z"
}
}
}
}
}'
and i got this error :
MapperParsingException[failed to parse [date]]; nested: IllegalArgumentException[Invalid format: "2016-04-05 15:50:47 +0900" is malformed at " 15:50:47 +0900"];
why this error happened?
thanks.
Can you please share a few of the results? What could happen is that the date format is different from what Kibana expects and that's why it does not find anything.
