Indexing Problem in Kibana


(Rahul) #1

I'm getting data from cloud watch but my date field have values in different formats how can i get those values without getting the field type error ?


(Magnus Bäck) #2

Use a date filter to parse the strings and convert the timestamp into a canonical format?


(Rahul) #3

I'm getting this error when i take the data in date field

"status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [dimensions.time.label] of different type, current_type [d ate] , merged_type [text]"}}}}


(Magnus Bäck) #4

Yeah, that's what happens when you haven't aligned the date format. The field has been mapped as a date but you're trying to index a document whose field has another format that can't be crammed into the field.


(Rahul) #5

Okay I'll try to make it work and let you know if i face some errors

Thanks a lot


(Rahul) #6

I tried using this but didn't get any success please help me out

filter {
date {
match => [ "dimensions.time.label", "MMM dd yyyy HH:mm:ss",
"MMM d yyyy HH:mm:ss", "ISO8601" ]
}
}


(Magnus Bäck) #7

Seriously, how do you expect us to be able to help with your date parsing when we don't know what your dates look like? Use a stdout { codec => rubydebug } output to dump the raw events.


(system) #8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.