Help needed for field to template date mapping

[SathishPrakasam (Sathishkumar Prakasam)]

Hi team,

My date mapping from logstash,

logstash:

date
{
match => [ "logtime" , "yyyy-MM-dd HH:mm:ss" ]
timezone => UTC
}

Field mapping in the template:

"logtime": {"type": "date","format":"yyyy-MM-dd HH:mm:ss"},

When the logstash maps the filed with template am getting below error,

[2019-11-22T15:06:29,634][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"lsh-usa_verizon_core2a_8650sdm_v4-2019.11.22", :_type=>"doc", :_routing=>nil}, #LogStash::Event:0x6d8370d6], :response=>{"index"=>{"_index"=>"lsh-usa_verizon_core2a_8650sdm_v4-2019.11.22", "_type"=>"doc", "_id"=>"yLXwlG4BIqQPqzL4CoVd", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to find type parsed [string] for [logtime]"}}}}

Can some one help where am i missing and how to fix this?

Regards,
Sathish

[elasticforme (Sachin)]

I generally have to do target in date filter.

date
{
match => [ "logtime" , "yyyy-MM-dd HH:mm:ss" ]
timezone => UTC
target => "logtime"
}

what is your output when you do without date filter.?
may be that field is null or something else for that record.