Issue parsing date

i'm having trouble figuring out what is wrong with my date filter.

"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [datetime]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"2017-06-15 14:57:36\" is malformed at \" 14:57:36\""}}}

The match im using is

match => [ "datetime", "yyyy-MM-dd HH:mm:ss" ]

i can see it seems to have an issue with the start of the time part but i dont understand why.

it seems that this was being parsed elsewhere in the config. once i renamed it it started working correctly.

It's Elasticsearch complaining, not Logstash. When this happens you need to inspect the field's mapping in ES.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.