Logstash date parsing error ( date field doesn't have any time)

(Arjun Subramanyam Varalakshmi) #1

down vote
My data has date in the format yyyy-MM-dd ex : "2015-10-12"

My logstash date filter is as below

date {
match => ["start_date", "yyyy-MM-dd"]
target => "start_date"
However, my es instance is not able to parse it and I'm getting following error

"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [study.startDate]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: "2012-04-17T00:00:00.000Z" is malformed at "T00:00:00.000Z""}}}}

(Magnus Bäck) #2

What's the mapping of the field in ES?

(Arjun Subramanyam Varalakshmi) #3

"startDate": {
"type": "date",
"format": "yyyy-MM-dd"

(Magnus Bäck) #4

I guess you can't stuff "2012-04-17T00:00:00.000Z" into a field that accepts a yyyy-MM-dd date format. I suppose ES in this case autodetected the previous field value (containing just the date) as a yyyy-MM-dd date. Mappings can't be changed without reindexing so if possible the easiest way out would be to just delete the index and start over.

(Arjun Subramanyam Varalakshmi) #5

@magnusbaeck deleting the old template file and re-processing worked, Thank you

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.