I'm getting data from cloud watch but my date field have values in different formats how can i get those values without getting the field type error ?
Use a date filter to parse the strings and convert the timestamp into a canonical format?
1 Like
I'm getting this error when i take the data in date field
"status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [dimensions.time.label] of different type, current_type [d ate] , merged_type [text]"}}}}
Yeah, that's what happens when you haven't aligned the date format. The field has been mapped as a date but you're trying to index a document whose field has another format that can't be crammed into the field.
Okay I'll try to make it work and let you know if i face some errors
Thanks a lot
I tried using this but didn't get any success please help me out
filter {
date {
match => [ "dimensions.time.label", "MMM dd yyyy HH:mm:ss",
"MMM d yyyy HH:mm:ss", "ISO8601" ]
}
}
Seriously, how do you expect us to be able to help with your date parsing when we don't know what your dates look like? Use a stdout { codec => rubydebug } output to dump the raw events.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.