Invalid date 'February 29' as '1970' is not a leap year

Elastic Stack Logstash
1

Posting here again as this has caused some real pain trying to figure out how to get this data into Elastic. Ultimately we will reconfigure this log file for the 1 day of the year to be a different date format that includes the year. If Logstash has to infer the year as "this year" it for some reason falls back to 1970 instead but only on Feb 29th.

[2020-03-01T20:22:55,606][WARN ][logstash.outputs.elasticsearch][main] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-syslog-dns-2020", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x74faead0>], :response=>{"index"=>{"_index"=>"logstash-syslog-dns-2020", "_type"=>"_doc", "_id"=>"hPdEmXABj79p_VhzmiEt", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [date] of type [date] in document with id 'hPdEmXABj79p_VhzmiEt'. Preview of field's value: 'Feb 29 04:37:29'", "caused_by"=>{"type"=>"date_time_exception", "reason"=>"Invalid date 'February 29' as '1970' is not a leap year"}}}}}

2

elasticsearch is inferring the year, not logstash.

3

Even when the error is happening in the LogStash log? I don't think it ever makes it to Elastic as LogStash throws the error before ever tying to ship the data to Elastic.

4

Yes.

logstash tries to write an event with "Feb 29 04:37:29" in the [date] field. elasticsearch responds with a 400 error and the exception elasticsearch reports is "Invalid date 'February 29' as '1970' is not a leap year".

5

This is great information. If I figure out a way to send Elastic the records with a full date including the year, will it work fine with no error?

6

I would expect it to be fine if you include the year.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.