Logstash date parse failure for jdbc input

Elastic Stack Logstash
1

Hi there,

I currently encounter a strange problem while trying to get my Oracle->ES transfer working.

Input is pretty much only jdbc and a "select event_timestamp from table" where the column in the database is a "TIMESTAMP WITH TIME ZONE"

My filter looks like this:

date
{
    match => [ "event_timestamp", "ISO8601" ]
}

but for whatever kind of reason, I get consistent dateparsefailures, where I'm under the impression that event_timestamp pretty much matches the ISO8601 format?

{
         "@timestamp" => 2017-07-10T15:30:05.072Z,
           "@version" => "1",
    "event_timestamp" => 2017-07-06T14:13:14.555Z,
               "tags" => [
        [0] "_dateparsefailure"
    ]
}

Is there any way to debug the date parser?

regards,
Bernhard

2

This exact topic was discussed in a thread that was active yesterday or possibly the day before that. Please see the archives.

3

This issue contains links to previous threads:

1 Like
4

thanks, I don't know why I haven't found those threads when I used the search function.

5

the solution is to create a new field from the timestamp, which is then a string, which can be parsed by the date filter...

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.