I'm having this weird problem where Logstash is throwing this error left and right:
{:timestamp=>"2016-10-13T12:08:24.357000+0000", :message=>"Failed parsing date from field", :field=>"log_timestamp", :value=>"%{Date} %{Time}", :exception=>"Invalid format: \"%{Date} %{Time}\"", :config_parsers=>"YYYY-MM-dd HH:mm:ss.SSS", :config_locale=>"default=en_US", :level=>:warn}
I have a date and field coming from separate fields, I combine them and then parse them. In ES I cannot see any errors, everything looks fine in my data.
Here's my config:
grok {
match => ["message", "%{DATA:Date} %{DATA:Time}"]
}
mutate {
add_field => {
"log_timestamp" => "%{Date} %{Time}"
}
}
date {
match => [ "log_timestamp", "YYYY-MM-dd HH:mm:ss.SSS" ]
timezone => "Etc/UTC"
}
Relevant part of my logfile:
2016-10-13 06:10:50.346 (Disqus truncates the 4 spaces between the two but they're there)
So my question is really: How do I troubleshoot this? In elasticsearch everything looks fine. Im not getting any dateparse errors in my tags. So what's this warning all about?