Filebeat timestamp not working

Elastic Stack Elasticsearch
1

Hi all. I'm trying to tell Filebeat to use my timestamp, rather than creating one. I'm getting this error:

"error": "failed parsing time field _app.ACTUAL_TIME='2023-08-01T11:49:09.386Z'", "errorCauses": [{"error": "failed using layout [2023-08-01T11:23:28.710Z] cannot parse [-08-01T11:49:09.386Z] as [3]"}]}

Could anybody help?

This is my filebeat.yml fragment:

processors:
  - timestamp:
      field: _app.ACTUAL_TIME
      layouts:
        - '2023-08-01T11:49:09.323Z'

The layout is copied direct from the value of _app.ACTUAL_TIME.

Thanks!

2

I'll answer my own question in case anybody's ever reading this.

:slight_smile:

Apparently, the layout MUST be for this EXACT 2006 date, adjusted for your format:

  • timestamp:
    field: _app.ACTUAL_TIME
    layouts:
    - '2006-01-02T15:04:05.000Z'
    test:
    - '2023-08-01T11:49:09.323Z'

Don't know why. Must be somebody's birthday.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.