It looks like you have a mapping that isn't able to handle the timestamp in your sample entry, which includes fractions of a second and additional information after the timezone. It might be easier to format your timestamp data as one of the built-in formats. Otherwise, you'll need to revise the mapping you have. See this for more formatting info. Once you have the correct format, Kibana should recognize that timestamp is a valid time field.
thanks much.. yeah i figured date format is causing this..however when i try to re-index with adding metadata field for timestamp using logstash filters..its taking current time as timestamp not the timestamp field in message..any way to extract that out?
I believe Logstash is inserting the current time based on this answer. Since your timestamp field is a string upon being input into Logstash, I think you'll have to format the string and convert it into a date. This should be of assistance.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.