Ingest node processor "date": unable to parse date

Elastic Stack Elasticsearch
1

Hello,

I am using the following pattern to parse date in Logstash:
date {
match => [ "date", "yyyy-MM-dd'T'HH:mm:ss" ]
}

(note 'T' in the middle). It works as expected.

Now I want to move away from LS and use Ingest node instead.

I define the following processor:

"date": {
"field": "date",
"target_field": "timestamp",
"formats": [ "yyyy-MM-dd'T'HH:mm:ss" ]
}

and ES throws an exception:

"type" : "exception",
"reason" : "java.lang.IllegalArgumentException: Illegal pattern component: T",
"caused_by" : {
"type" : "illegal_argument_exception",
"reason" : "Illegal pattern component: T"
},
"header" : {
"processor_type" : "date"
}
},
"status" : 500

What's wrong with it? How can I define a date pattern to match a date with "T" in the middle?

Thanks.

2

Look at the formats here: https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html#mapping-date-format

basic_date_time is what you want I think.

3

Yes, but why does it throw exception if I define date format inline (with the same syntax)? And also it works as expected with Logstash.

4

Did you try with the one I proposed ?

I mean that in docs, it's mentioned that it must be a JODA date format.

Might be a bug though.

5

If I use
"date": {
"field": "date",
"target_field": "date",
"formats": [ "basic_date_time_no_millis" ]
},

I get

"type" : "exception",
"reason" : "java.lang.IllegalArgumentException: Illegal pattern component: b",
"caused_by" : {
"type" : "illegal_argument_exception",
"reason" : "Illegal pattern component: b"
},
"header" : {
"processor_type" : "date"
}
},
"status" : 500

6

Interesting.

I'm AFK so I can't really check.

May be open an issue then and link to this thread?

7
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.