Invalid malformaed date

Elastic Stack Logstash
1

Hi,
Im facing below error while processing log kindly help me to resolve the issue,

Error:

Failed parsing date from field {:field=>"iis_eventDate", :value=>"2017-03-12 02:01:43", :exception=>"Cannot parse \"2017-03-12 02:01:43\": Illegal instant due to time zone offset transition (America/Los_Angeles)", :config_parsers=>"YYYY-MM-dd HH:mm:ss", :config_locale=>"default=en_US", :level=>:warn}
NoMethodError: undefined method `>=' for nil:NilClass
    output_func at (eval):2918
   output_batch at /beep/envs/beep/software/logstash-2.3.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/pipeline.rb:297
           each at org/jruby/RubyArray.java:1613
         inject at org/jruby/RubyEnumerable.java:852
   output_batch at /beep/envs/beep/software/logstash-2.3.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/pipeline.rb:291
    worker_loop at /beep/envs/beep/software/logstash-2.3.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/pipeline.rb:236
  start_workers at /beep/envs/beep/software/logstash-2.3.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/pipeline.rb:205

Input:
2017-03-12 02:01:43 aaa POST xxx yyy 80 reynaj zzz Mozilla/5.0+(Windows+NT+10.0)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/56.0.2924.87+Safari/537.36 200 0 0 942

Code;
request_date:2017-03-12
request_time:02:01:43

    mutate {
        add_field => {
          
    	  "iis_eventDate" => "%{request_date} %{request_time}"
        }
      }
    date { 
          match => ["iis_eventDate", "YYYY-MM-dd HH:mm:ss" ] 
    	  target => ["iis_eventDate"]     
        }
2

I don't think you should be specifying the target in this case.

3

@JeremyinNC

If i command target line also it replicate same error :frowning:

4

Do you need to use lowercase "y" for year? I don't see capital Y for year anywhere in the docs.

match => ["iis_eventDate", "yyyy-MM-dd HH:mm:ss" ]
5

Okay, Let me check with lowercase "y" and let you know but i have tell on thing previously it was working fine with same condition last 3 days only it not processing any logs.

6

@JeremyinNC

When i try with lowercase "yyyy", it replicate the same error.

7

What about the following (are your time stamps zulu (UTC) time)?

"iis_eventDate" => "%{request_date}:%{request_time} Z"

 match => [ "iis_eventDate" , "dd/MMM/yyyy:HH:mm:ss Z"
8

@JeremyinNC
Still pursuit same issue :frowning:

9

What does the mapping for your index show as the type for iis_eventDate?

10

@JeremyinNC

Please find the below mapping
name : iis_eventDate
Type: date

11

@JeremyinNC

Now im getting this error also,

Unknown error while looking up GeoIP data {:exception=>#<Errno::EBADF: Bad file descriptor - Bad file descriptor>, :field=>"request_remoteIP", :event=>2017-03-15T09:20:38.600Z xxx 2017-03-10 14:44:42 11111 POST /Parts/ConfirmationReport/GetPartOrderLineItemsConfirmation |11|22|33|44|55| 80 jonesj158 123.34.5.00 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.1;+WOW64;+Trident/7.0;+SLCC2;+.NET+CLR+2.0.50727;+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30729;+.NET4.0C;+.NET4.0E;+InfoPath.3) 200 0 0 184, :level=>:error}

Input:

2017-03-10 14:44:42 11111 POST /Parts/ConfirmationReport/GetPartOrderLineItemsConfirmation |11|22|33|44|55| 80 jonesj158 123.34.5.00 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.1;+WOW64;+Trident/7.0;+SLCC2;+.NET+CLR+2.0.50727;+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30729;+.NET4.0C;+.NET4.0E;+InfoPath.3) 200 0 0 184

you can find the event is diff compare with input. using csv filter to create fields

12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.