Filebeat @timestamp not overwritten parsing error

Elastic Stack Beats
1

Hello,
i see this warning in filebeat logs:

2022-11-08T15:24:21.094Z        ERROR   [jsonhelper]    jsontransform/jsonhelper.go:62  JSON: Won't overwrite @timestamp because of parsing error: parsing time "2022-11-07T14:43:53.815430" as "2006-01-02T15:04:05Z07:00": cannot parse "" as "Z07:00"
2022-11-08T15:24:21.094Z        ERROR   [jsonhelper]    jsontransform/jsonhelper.go:62  JSON: Won't overwrite @timestamp because of parsing error: parsing time "2022-11-07T14:43:58.787702" as "2006-01-02T15:04:05Z07:00": cannot parse "" as "Z07:00"
2022-11-08T15:24:21.094Z        ERROR   [jsonhelper]    jsontransform/jsonhelper.go:62  JSON: Won't overwrite @timestamp because of parsing error: parsing time "2022-11-07T14:44:03.795769" as "2006-01-02T15:04:05Z07:00": cannot parse "" as "Z07:00"
2022-11-08T15:24:21.094Z        ERROR   [jsonhelper]    jsontransform/jsonhelper.go:62  JSON: Won't overwrite @timestamp because of parsing error: parsing time "2022-11-07T14:44:03.861020" as "2006-01-02T15:04:05Z07:00": cannot parse "" as "Z07:00"
2022-11-08T15:24:21.094Z        ERROR   [jsonhelper]    jsontransform/jsonhelper.go:62  JSON: Won't overwrite @timestamp because of parsing error: parsing time "2022-11-07T14:44:06.037150" as "2006-01-02T15:04:05Z07:00": cannot parse "" as "Z07:00"

filebeat.inputs:
- type: log
  json.keys_under_root: true
  json.overwrite_keys: true
  fields_under_root: true
  fields: {
    application: app01
  }
  paths:
    - "/var/log/app01/*.log"
  ignore_older: 48h

I’m using Python’s "loggin" library.

Is there any way to fixed this through filebeat?

Thanks for the help.

Regards,

2

Tips to Fix Formula Parse Errors

Check your formula inputs and make sure they're correct.
Use the IFERROR function and display a different result if an error occurs.
Check your spelling and make sure all the parentheses are in the right places.
Make sure you're using the correct operators.

Greeting,
Rachel Gomez

3

I’m sorry but I don’t understand the answer

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.