Hi everyone,
i have a weird log parsing error I failed to solve, maybe someone here can assist me.
I have a docker container shipping logs in this (simple?) format:
2021-06-14 08:30:14 ERROR Some message
I am shipping them to Logstash using filebeat with this config:
filebeat.autodiscover:
providers:
- type: docker
templates:
- condition:
equals:
docker.container.name: Home-Assistant
config:
- type: container
paths:
- /var/lib/docker/containers/${data.docker.container.id}/*.log
In Logstash my pipeline config looks like this:
filter {
if [container][name] == "Home-Assistant" {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:message}" }
# (%{DATA:thread}) \[%{DATA:class}\] (?<message>(.|\r|\n)*)
overwrite => ["message"]
}
}
}
Parsing this line fails with "Could not index event to Elasticsearch." and the following log in Logstash.
"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [timestamp] of type [date] in document with id 'c542CXoBwxcEamlAvRaR'. Preview of field's value: '2021-06-14 08:30:14'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"failed to parse date field [2021-06-14 08:30:14] with format [strict_date_optional_time||epoch_millis]", "caused_by"=>{"type"=>"date_time_parse_exception", "reason"=>"Failed to parse with all enclosed parsers"}}}}}}
I understand that there is some problem parsing the timestamp but I have no idea why. Any help is appreciated.
P.S. : This line is parsed perfectly fine in grok debugger.