How to send NULL DATE value to elasticsearch using logstash

Elastic Stack Logstash
#1

Hi,
Its a blocker to me.
I am not able to send NULL DATE value to the elasticsearch using logstash.
null value storing as string in elasticsearch.
if actual comes with proper date like 2012-01-01 11:11:11 it is also string as string even after converting to date using with the date filter.

Thanks in advance.

#2

Are you using timebased indices?

#3

yes
monthly indices,weekly indices

#4

Then what is the value in sending a null timestamp? It'll just get put into the wrong index.

#5

I have one date field called datetime.
it can have null values(null) and date values(2011-01-01 11:11:11.111).
I am converting this date field to date using date filter like below

if[datetime]!='null' and [datetime]!='NULL'{
date {
match => [ "datetime", "YYYY-MM-dd HH:mm:ss.SSS" ]
target =>"datetime"
timezone=>"Asia/Kolkata"
}
}
if it is null logstash storing as null string like 'null'.
it should be store as null only.

#6

Except that will break in ES because it is not a valid timestamp.
I don't think there is a good solution to your problem here.

#7

null date valid only .
In RDBMS we can store null date also.why cant in ES

#8

Elasticsearch allows to store null dates using api
URL:http://localhost:9200/test_index/test_type/1
BODY:{"ANSWEREDON":null}
if we check mapping ANSWEREDON data type is date only.
But from logstash not able to store null date.

#9