Hello,
I configured my elasticsearch with file beat. When my file is changed I get the following error from filebeat:
can someone helpme understand this error?
can someone helpme understand this error?
Can you post the complete error message, and preferably not as a screenshot but as actual text? Also, which versions of Filebeat and Elasticsearch are you using?
Hello its running on powershell but what I can see is that the error is on the timestamp format:
where can I change the format that filebeat searches?
thanks
We're going to need some more information. Could you post your filebeat.yml configuration file?
Shaunak
Hello,
My filebeat.yml is:
Logs do uipath
filebeat.inputs:
- type: log
paths:- 'C:\Users\dto.rpa\AppData\Local\UiPath\Logs\Execution.log'
output.elasticsearch:
hosts: ["localhost:9200"]
username: "elastic"
password: ""
index: "uipathlogs"
pipeline: "uipathlogs-pipeline"
setup:
template.enabled: false
ilm.enabled: false
I think this error might be coming from the uipathlogs-pipeline Elasticsearch ingest pipeline. Could you post that pipeline here please, delimited by ``` so it's properly formatted and easy to read?
Thanks,
Shaunak
Hello, Thanks again for your help. The pipeline is:
[
{
"date": {
"field": "timeStamp",
"formats": [
"ISO8601"
],
"output_format": "yyyy-MM-dd'T'HH:mm:ss.SSSSSSSSSXXX"
}
}
]
From looking at the event in your error screenshot, I don't see a timeStamp field in there. That would explain this error.
The log has a timeStamp, hpow can I sove?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.