Hi,
I'm trying to use a date with the following format Jan 25, 2018 13:02:38.015514516 CET in my data as main timestamp.
I've tried to parse it in logstash with
date { match => ["frame.date", "MMM dd, yyyy HH:mm:ss.SSS Z"] target => ["my_timestamp"] }
Without success (grok parsing failure on that field).
Then I've tried to create an elasticsearch index template to specify my date format
PUT _template/mytemplate { "index_patterns": "dataindex-*", "mappings": { "properties": { "frame": { "properties": { "time": { "type": "date", "format": "MMM dd, yyyy HH:mm:ss.SSS Z" }
without parsing success either. The error message is:
[2020-03-25T17:25:09,706][WARN ][logstash.outputs.elasticsearch][main] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"dataindex-2020-03-25", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x13487e91>], :response=>{"index"=>{"_index"=>"dataindex-2020-03-25", "_type"=>"_doc", "_id"=>"IKaDEnEBrzzDqCjNCCkH", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [frame.time] of type [date] in document with id 'IKaDEnEBrzzDqCjNCCkH'. Preview of field's value: 'Jan 25, 2018 13:02:38.015514516 CET'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"failed to parse date field [Jan 25, 2018 13:02:38.015514516 CET] with format [MMM dd, yyyy HH:mm:ss.SSS Z]", "caused_by"=>{"type"=>"date_time_parse_exception", "reason"=>"Text 'Jan 25, 2018 13:02:38.015514516 CET' could not be parsed at index 25"}}}}}}
Is it due to the number of decimals in my timestamp?