# Failed to parse field "tls.certificate\_not\_valid\_before" from heartbeat

**URL:** <https://discuss.elastic.co/t/failed-to-parse-field-tls-certificate-not-valid-before-from-heartbeat/165707>\
**Category:** Beats\
**Tags:** heartbeat\
**Created:** [January 25, 2019, 7:12am UTC](https://discuss.elastic.co/t/failed-to-parse-field-tls-certificate-not-valid-before-from-heartbeat/165707 "2019-01-25T07:12:21Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [January 25, 2019, 7:12am UTC](https://discuss.elastic.co/t/failed-to-parse-field-tls-certificate-not-valid-before-from-heartbeat/165707/1 "2019-01-25T07:12:21Z")

</div>

Hello,

I have installed a clean installation of Elasticsearch 6.5.4 and heartbeat 6.5.4(Elasticsearch uses HTTPS).  
My heartbeat config is as follows:  
heartbeat.monitors:  
- type: http

```
  # List or urls to query
  urls: ["https://myurl:9200"]
  username: "beats_system"
  password: "${output.elasticsearch.password}"
  ssl.certificate_authorities: ["/logserver/applications/pki/myCA.crt"]
  check.request.method: GET
  check.response.status: 200

  # Configure task schedule
  schedule: '@every 60s'

```

After starting heartbeat I get the following error in the heartbeat log:  
2019-01-25T07:59:53.007+0100 WARN elasticsearch/client.go:521 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0x3295cd29, ext:63683996391, loc:(\*time.Location)(0x1fc6920)}, Meta:common.MapStr(nil), Fields:common.MapStr{"monitor":map[string]interface {}{"host":"myurl", "ip":"XXX.XXX.XXX.XXX", "duration":map[string]interface {}{"us":0x26da6}, "status":"down", "scheme":"https", "id":"http@[https://myurl:9200](https://myurl:9200)", "name":"http", "type":"http"}, "resolve":map[string]interface {}{"host":"myurl", "ip":"XXX.XXX.XXX.XXX", "rtt":map[string]interface {}{"us":0x1b8}}, "beat":map[string]interface {}{"hostname":"myurl", "version":"6.5.4", "name":"myurl"}, "host":map[string]interface {}{"containerized":true, "name":"myurl", "architecture":"x86\_64", "os":map[string]interface {}{"codename":"Maipo", "platform":"rhel", "version":"7.6 (Maipo)", "family":""}, "id":"b7ab972bc56541c3aabfab009d16ad0d"}, "error":map[string]interface {}{"type":"validate", "message":"received status code 401 expecting 200"}, "http":map[string]interface {}{"url":"[https://myurl:9200](https://myurl:9200)", "rtt":map[string]interface {}{"content":map[string]interface {}{"us":0x20}, "total":map[string]interface {}{"us":0x26a4b}, "write\_request":map[string]interface {}{"us":0x5a}, "response\_header":map[string]interface {}{"us":0x1ca21}, "validate":map[string]interface {}{"us":0x1ca42}}, "response":map[string]interface {}{"status\_code":0x191}}, "tcp":map[string]interface {}{"port":0x23f0, "rtt":map[string]interface {}{"connect":map[string]interface {}{"us":0xcb}}}, "tls":map[string]interface {}{"certificate\_not\_valid\_before":map[string]interface {}(nil), "certificate\_not\_valid\_after":map[string]interface {}(nil), "rtt":map[string]interface {}{"handshake":map[string]interface {}{"us":0x9ea2}}}}, Private:interface {}(nil)}, Flags:0x0} (status=400): {"type":"mapper\_parsing\_exception","reason":"failed to parse field [tls.certificate\_not\_valid\_before] of type [date]","caused\_by":{"type":"illegal\_state\_exception","reason":"Can't get text on a START\_OBJECT at 1:129"}}

Can anyone advise what I am doing wrong?

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [February 1, 2019, 9:55pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-tls-certificate-not-valid-before-from-heartbeat/165707/2 "2019-02-01T21:55:07Z")

</div>

Can you try the just released 6.6 version? This should now be fixed.

---

<div class="post-metadata">

**Author:** ![Jeeppler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeeppler/32/43151_2.png) [@Jeeppler](https://discuss.elastic.co/u/Jeeppler)\
**Post date:** [February 1, 2019, 11:45pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-tls-certificate-not-valid-before-from-heartbeat/165707/3 "2019-02-01T23:45:58Z")

</div>

@Andrew_Cholakian1 an you explain why this is fixed in 6.6? Can you point to a card or issue regarding this problem?

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [February 4, 2019, 6:26am UTC](https://discuss.elastic.co/t/failed-to-parse-field-tls-certificate-not-valid-before-from-heartbeat/165707/4 "2019-02-04T06:26:54Z")

</div>

Which product must be upgraded? Is it enough to upgrade the heartbeat so I can test if this is fixed or do I have to upgrade ElasticSearch?

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [February 4, 2019, 1:33pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-tls-certificate-not-valid-before-from-heartbeat/165707/5 "2019-02-04T13:33:33Z")

</div>

Only heartbeat needs to be upgraded

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [February 4, 2019, 2:13pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-tls-certificate-not-valid-before-from-heartbeat/165707/6 "2019-02-04T14:13:43Z")

</div>

Do I have to do anything else? I upgraded to heartbeat 6.6, added my configuration and I still get:

> Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0x1894b8a7, ext:63684886235, loc:(\*time.Location)(0x1fe0a20)}, Meta:common.MapStr(nil), Fields:common.MapStr{"host":map[string]interface {}{"name":"host", "id":"b7ab972bc56541c3aabfab009d16ad0d", "containerized":true, "architecture":"x86\_64", "os":map[string]interface {}{"family":"", "name":"Red Hat Enterprise Linux Server", "codename":"Maipo", "platform":"rhel", "version":"7.6 (Maipo)"}}, "monitor":map[string]interface {}{"scheme":"https", "id":"http@[https://host:9200](https://host:9200)", "name":"http", "type":"http", "host":"host", "ip":"XXX.XXX.XXX.XXX", "duration":map[string]interface {}{"us":0x20e2b}, "status":"down"}, "resolve":map[string]interface {}{"host":"[sn1log02.ad001.siemens.net](http://sn1log02.ad001.siemens.net)", "ip":"139.23.156.204", "rtt":map[string]interface {}{"us":0x288}}, "error":map[string]interface {}{"message":"received status code 401 expecting 200", "type":"validate"}, "http":map[string]interface {}{"rtt":map[string]interface {}{"content":map[string]interface {}{"us":0x19}, "total":map[string]interface {}{"us":0x20ae3}, "write\_request":map[string]interface {}{"us":0x31}, "response\_header":map[string]interface {}{"us":0x1d2bd}, "validate":map[string]interface {}{"us":0x1d2d6}}, "response":map[string]interface {}{"status\_code":0x191}, "url":"[https://host:9200](https://host:9200)"}, "tcp":map[string]interface {}{"rtt":map[string]interface {}{"connect":map[string]interface {}{"us":0x433}}, "port":0x23f0}, "tls":map[string]interface {}{"certificate\_not\_valid\_before":map[string]interface {}(nil), "certificate\_not\_valid\_after":map[string]interface {}(nil), "rtt":map[string]interface {}{"handshake":map[string]interface {}{"us":0x335b}}}, "beat":map[string]interface {}{"hostname":"host", "version":"6.6.0", "name":"host"}}, Private:interface {}(nil)}, Flags:0x0} (status=400): {"type":"mapper\_parsing\_exception","reason":"failed to parse field [tls.certificate\_not\_valid\_before] of type [date]","caused\_by":{"type":"illegal\_state\_exception","reason":"Can't get text on a START\_OBJECT at 1:1112"}}

I should add that the server has a valid from and valid until set so I am not sure why heartbeat might not read them...

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [February 4, 2019, 5:01pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-tls-certificate-not-valid-before-from-heartbeat/165707/7 "2019-02-04T17:01:52Z")

</div>

Hmmm, this is a different error. I'm unable to reproduce it myself. It seems that bad data is being sent to ES.

Can you run heartbeat with the `-d "publish"` flag enabled and check your logs? This will cause heartbeat to log each event it sends to Elasticsearch with its full JSON. The lines should start with: `2019-02-04T11:00:00.174-0600	DEBUG	[publish]	pipeline/processor.go:308	Publish event:`.

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [February 4, 2019, 5:02pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-tls-certificate-not-valid-before-from-heartbeat/165707/8 "2019-02-04T17:02:30Z")

</div>

Also, can you share your system info? Operating system and version would be great to know, as well as if any proxies are enabled.

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [February 4, 2019, 5:36pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-tls-certificate-not-valid-before-from-heartbeat/165707/9 "2019-02-04T17:36:05Z")

</div>

Also, do you get this issue against any public website URLs? I'd love to be able to repro this.

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [February 5, 2019, 6:15am UTC](https://discuss.elastic.co/t/failed-to-parse-field-tls-certificate-not-valid-before-from-heartbeat/165707/10 "2019-02-05T06:15:11Z")

</div>

Unfortunately, I cannot access the internet so I cannot test against public urls. The server is a redhat enterprise linux 7 and the event is:

> {  
> "@timestamp": "2019-02-05T06:05:25.377Z",  
> "@metadata": {  
> "beat": "heartbeat",  
> "type": "doc",  
> "version": "6.6.0"  
> },  
> "error": {  
> "type": "validate",  
> "message": "received status code 401 expecting 200"  
> },  
> "tcp": {  
> "rtt": {  
> "connect": {  
> "us": 378  
> }  
> },  
> "port": 9200  
> },  
> "tls": {  
> "certificate\_not\_valid\_before": "2019-01-22T09:10:13.000Z",  
> "certificate\_not\_valid\_after": "2020-01-22T09:10:13.000Z",  
> "rtt": {  
> "handshake": {  
> "us": 15199  
> }  
> }  
> },  
> "http": {  
> "response": {  
> "status\_code": 401  
> },  
> "rtt": {  
> "total": {  
> "us": 125907  
> },  
> "write\_request": {  
> "us": 78  
> },  
> "response\_header": {  
> "us": 110184  
> },  
> "validate": {  
> "us": 110209  
> },  
> "content": {  
> "us": 25  
> }  
> },  
> "url": "[https://host:9200](https://host:9200)"  
> },  
> "monitor": {  
> "type": "http",  
> "host": "host",  
> "ip": "127.0.0.1",  
> "duration": {  
> "us": 126934  
> },  
> "status": "down",  
> "scheme": "https",  
> "id": "http@[https://host:9200](https://host:9200)",  
> "name": "http"  
> },  
> "beat": {  
> "version": "6.6.0",  
> "name": "host",  
> "hostname": "host"  
> },  
> "host": {  
> "name": "host",  
> "architecture": "x86\_64",  
> "os": {  
> "codename": "Maipo",  
> "platform": "rhel",  
> "version": "7.6 (Maipo)",  
> "family": "",  
> "name": "Red Hat Enterprise Linux Server"  
> },  
> "id": "b7ab972bc56541c3aabfab009d16ad0d",  
> "containerized": true  
> },  
> "resolve": {  
> "host": "host",  
> "ip": "127.0.0.1",  
> "rtt": {  
> "us": 764  
> }  
> }  
> }

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [February 5, 2019, 3:07pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-tls-certificate-not-valid-before-from-heartbeat/165707/11 "2019-02-05T15:07:29Z")

</div>

That looks like valid JSON for Elasticsearch

So, it would help to clarify a few things:

1. Are you still receiving those errors?
2. Are some events being indexed or none?
3. What is your current mapping if you `GET /heartbeat-*/_mappings` (you only need to share the most recent index's mapping).

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [February 6, 2019, 6:33am UTC](https://discuss.elastic.co/t/failed-to-parse-field-tls-certificate-not-valid-before-from-heartbeat/165707/12 "2019-02-06T06:33:01Z")

</div>

1. Yes we still receive those errors - but I have disabled all HTTPS endpoints when not testing...
2. Currently, only non-encrypted endpoints can be indexed.
3. The mapping is: [https://pastebin.com/NEjg6wJA](https://pastebin.com/NEjg6wJA)

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [March 4, 2019, 2:57pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-tls-certificate-not-valid-before-from-heartbeat/165707/13 "2019-03-04T14:57:43Z")

</div>

Do you have disk spooling turned on? This sounds a lot like [https://github.com/elastic/beats/issues/10099](https://github.com/elastic/beats/issues/10099)

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [March 5, 2019, 8:32am UTC](https://discuss.elastic.co/t/failed-to-parse-field-tls-certificate-not-valid-before-from-heartbeat/165707/14 "2019-03-05T08:32:28Z")

</div>

Hello Andrew,

Yes that was the root cause. Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 2, 2019, 8:32am UTC](https://discuss.elastic.co/t/failed-to-parse-field-tls-certificate-not-valid-before-from-heartbeat/165707/15 "2019-04-02T08:32:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.