Logstash : failed to parse field [@timestamp] of type [date]

This is my logstash.conf file. I am trying to read the data from mysql database and send it to elastic search. I am getting below error.

This is my index creation command :
curl -X POST -H "Content-Type: application/json" "http://localhost:9200/vm-mysql/_doc" -d '{"@timestamp": '1561310406', "data-source": "MYSQL", "assetname": "VARA2019CPU123456", "serial": "SR123456"}'

this is my logstash.conf file

input {
jdbc {
jdbc_connection_string => "jdbc:mysql://localhost:3306/ipcl"
# The user we wish to execute our statement as
jdbc_user => "root"
jdbc_password => ""
# The path to our downloaded jdbc driver
jdbc_driver_library => "mysql-connector-java-5.1.38.jar"
jdbc_driver_class => "com.mysql.jdbc.Driver"
# our query
statement => "SELECT name as assetname,serial FROM glpi_computers"
}
}

filter {
json {
source => "MYSQL"
}
date {
match => [ "date","UNIX_MS" ]
target => "@timestamp"
}
}

output {
stdout { codec => json_lines }
elasticsearch {
hosts => "localhost:9200"
manage_template => false
index => "vm-mysql"
}
}

Error :
[2019-07-16T21:36:51,016][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"vm-mysql", :_type=>"_doc", :routing=>nil}, #LogStash::Event:0x29f22037], :response=>{"index"=>{"_index"=>"vm-mysql", "_type"=>"_doc", "_id"=>"ydOJ-2sBW3M_PSjzWTE4", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [@timestamp] of type [date] in document with id 'ydOJ-2sBW3M_PSjzWTE4'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"failed to parse date field [2019-07-16T16:06:50.228Z] with format [epoch_second]", "caused_by"=>{"type"=>"date_time_parse_exception", "reason"=>"Failed to parse with all enclosed parsers"}}}}}}
[2019-07-16T21:36:51,918][INFO ][logstash.runner ] Logstash shut down.

It looks to me like your index has a mapping that tells it what formats are acceptable for that field, and the field is not one of those formats. Check the mapping.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.