Invalid malformaed date

Elastic Stack Logstash
#1

Hi,
Im facing below error while processing log kindly help me to resolve the issue,

Error:

Failed parsing date from field {:field=>"iis_eventDate", :value=>"2017-03-12 02:01:43", :exception=>"Cannot parse \"2017-03-12 02:01:43\": Illegal instant due to time zone offset transition (America/Los_Angeles)", :config_parsers=>"YYYY-MM-dd HH:mm:ss", :config_locale=>"default=en_US", :level=>:warn}
NoMethodError: undefined method `>=' for nil:NilClass
    output_func at (eval):2918
   output_batch at /beep/envs/beep/software/logstash-2.3.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/pipeline.rb:297
           each at org/jruby/RubyArray.java:1613
         inject at org/jruby/RubyEnumerable.java:852
   output_batch at /beep/envs/beep/software/logstash-2.3.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/pipeline.rb:291
    worker_loop at /beep/envs/beep/software/logstash-2.3.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/pipeline.rb:236
  start_workers at /beep/envs/beep/software/logstash-2.3.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/pipeline.rb:205

Input:
2017-03-12 02:01:43 aaa POST xxx yyy 80 reynaj zzz Mozilla/5.0+(Windows+NT+10.0)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/56.0.2924.87+Safari/537.36 200 0 0 942

Code;
request_date:2017-03-12
request_time:02:01:43

    mutate {
        add_field => {
          
    	  "iis_eventDate" => "%{request_date} %{request_time}"
        }
      }
    date { 
          match => ["iis_eventDate", "YYYY-MM-dd HH:mm:ss" ] 
    	  target => ["iis_eventDate"]     
        }
#2

I don't think you should be specifying the target in this case.

#3

@JeremyinNC

If i command target line also it replicate same error :frowning:

#4

Do you need to use lowercase "y" for year? I don't see capital Y for year anywhere in the docs.

match => ["iis_eventDate", "yyyy-MM-dd HH:mm:ss" ]
#5

Okay, Let me check with lowercase "y" and let you know but i have tell on thing previously it was working fine with same condition last 3 days only it not processing any logs.

#6

@JeremyinNC

When i try with lowercase "yyyy", it replicate the same error.

#7

What about the following (are your time stamps zulu (UTC) time)?

"iis_eventDate" => "%{request_date}:%{request_time} Z"

 match => [ "iis_eventDate" , "dd/MMM/yyyy:HH:mm:ss Z"
#8

@JeremyinNC
Still pursuit same issue :frowning:

#9

What does the mapping for your index show as the type for iis_eventDate?

#10

@JeremyinNC

Please find the below mapping
name : iis_eventDate
Type: date

#11

@JeremyinNC

Now im getting this error also,

Unknown error while looking up GeoIP data {:exception=>#<Errno::EBADF: Bad file descriptor - Bad file descriptor>, :field=>"request_remoteIP", :event=>2017-03-15T09:20:38.600Z xxx 2017-03-10 14:44:42 11111 POST /Parts/ConfirmationReport/GetPartOrderLineItemsConfirmation |11|22|33|44|55| 80 jonesj158 123.34.5.00 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.1;+WOW64;+Trident/7.0;+SLCC2;+.NET+CLR+2.0.50727;+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30729;+.NET4.0C;+.NET4.0E;+InfoPath.3) 200 0 0 184, :level=>:error}

Input:

2017-03-10 14:44:42 11111 POST /Parts/ConfirmationReport/GetPartOrderLineItemsConfirmation |11|22|33|44|55| 80 jonesj158 123.34.5.00 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.1;+WOW64;+Trident/7.0;+SLCC2;+.NET+CLR+2.0.50727;+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30729;+.NET4.0C;+.NET4.0E;+InfoPath.3) 200 0 0 184

you can find the event is diff compare with input. using csv filter to create fields

#12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.