"failed parsing time field" + "failed using layout"

Elastic Stack Beats
1

Hello,

I am trying to convert a microseconds precision time field to @timestamp but I got error messages.

A part of the Filebeat config lines, related to the issue:

processors:
  - decode_json_fields:
     fields: ["message"]
     process_array: true
     target: ""
     add_error_key: true
     overwrite_keys: true
  - timestamp:
      field: mytimestamp
      layouts:
        - '2020-01-02T12:34:56.123456Z'

and here is the error message from Filebeat log (debug level):

    2021-01-27T22:45:04.020+0100    DEBUG   [processor.timestamp]   timestamp/timestamp.go:173      Failure parsing time field.     {"error": "failed parsing time field mytimestamp='2021-01-27T21:45:04.003313Z'", "errorCauses": [{"error": "failed using layout [2020-01-02T12:34:56.123456Z] cannot parse [-01-27T21:45:04.003313Z] as [0-]"}]}

    2021-01-27T22:45:04.020+0100    DEBUG   [processors]    processing/processors.go:128    Fail to apply processor global{decode_json_fields=message, timestamp=[field=mytimestamp, target_field=@timestamp, timezone=UTC, layouts=[2020-01-02T12:34:56.123456Z]]}: failed parsing time field mytimestamp='2021-01-27T21:45:04.003313Z'

Versions:
Elasticsearch 7.10.2
Kibana: 7.10.2
FileBeat: 7.10.2

Does anybody has an idea what is wrong with the above time and with the layout?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.