When I try using a csv file, the harvesting fails.
below is the log from Filebeat:
Mar 17 19:03:26 issi01 filebeat[3989]: 2020-03-17T19:03:26.282+0530 INFO log/harvester.go:316 File was removed: /var/log/ghnlan/multimactest/00_17_41_41_00_13--17-03-2020_12-46-21_PM.csv. Closing because close_removed is enabled.
Mar 17 19:03:31 issi01 filebeat[3989]: 2020-03-17T19:03:31.276+0530 INFO log/harvester.go:297 Harvester started for file: /var/log/ghnlan/multimactest/00_17_41_41_00_1f--13-03-2020_04-56-11_PM.csv
Mar 17 19:03:32 issi01 filebeat[3989]: 2020-03-17T19:03:32.283+0530 ERROR logstash/async.go:256 Failed to publish events caused by: write tcp 127.0.0.1:55206->127.0.0.1:5044: write: connection reset by peer
Mar 17 19:03:33 issi01 filebeat[3989]: 2020-03-17T19:03:33.360+0530 ERROR pipeline/output.go:121 Failed to publish events: write tcp 127.0.0.1:55206->127.0.0.1:5044: write: connection reset by peer
Mar 17 19:03:33 issi01 filebeat[3989]: 2020-03-17T19:03:33.360+0530 INFO pipeline/output.go:95 Connecting to backoff(async(tcp://127.0.0.1:5044))
Mar 17 19:03:33 issi01 filebeat[3989]: 2020-03-17T19:03:33.360+0530 INFO pipeline/output.go:105 Connection to backoff(async(tcp://127.0.0.1:5044)) established
below is the log from logstash:
[2020-03-17T19:03:33,691][WARN ][logstash.outputs.elasticsearch][main] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"issi_plots-2020.03.17", :routing=>nil, :_type=>"_doc"}, #LogStash::Event:0x5d815b21], :response=>{"index"=>{"_index"=>"issi_plots-2020.03.17", "_type"=>"_doc", "_id"=>"g7Oz6HABNb5UYHxsDsEI", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [TimeStamp] of type [date] in document with id 'g7Oz6HABNb5UYHxsDsEI'. Preview of field's value: 'TimeStamp'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"failed to parse date field [TimeStamp] with format [strict_date_optional_time||epoch_millis]", "caused_by"=>{"type"=>"date_time_parse_exception", "reason"=>"Failed to parse with all enclosed parsers"}}}}}}
can anyone please help fixing this ?