This is my logstash.conf file. I am trying to read the data from mysql database and send it to elastic search. I am getting below error.
This is my index creation command :
curl -X POST -H "Content-Type: application/json" "http://localhost:9200/vm-mysql/_doc" -d '{"@timestamp": '1561310406', "data-source": "MYSQL", "assetname": "VARA2019CPU123456", "serial": "SR123456"}'
this is my logstash.conf file
input {
jdbc {
jdbc_connection_string => "jdbc:mysql://localhost:3306/ipcl"
# The user we wish to execute our statement as
jdbc_user => "root"
jdbc_password => ""
# The path to our downloaded jdbc driver
jdbc_driver_library => "mysql-connector-java-5.1.38.jar"
jdbc_driver_class => "com.mysql.jdbc.Driver"
# our query
statement => "SELECT name as assetname,serial FROM glpi_computers"
}
}
filter {
json {
source => "MYSQL"
}
date {
match => [ "date","UNIX_MS" ]
target => "@timestamp"
}
}
output {
stdout { codec => json_lines }
elasticsearch {
hosts => "localhost:9200"
manage_template => false
index => "vm-mysql"
}
}
Error :
[2019-07-16T21:36:51,016][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"vm-mysql", :_type=>"_doc", :routing=>nil}, #LogStash::Event:0x29f22037], :response=>{"index"=>{"_index"=>"vm-mysql", "_type"=>"_doc", "_id"=>"ydOJ-2sBW3M_PSjzWTE4", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [@timestamp] of type [date] in document with id 'ydOJ-2sBW3M_PSjzWTE4'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"failed to parse date field [2019-07-16T16:06:50.228Z] with format [epoch_second]", "caused_by"=>{"type"=>"date_time_parse_exception", "reason"=>"Failed to parse with all enclosed parsers"}}}}}}
[2019-07-16T21:36:51,918][INFO ][logstash.runner ] Logstash shut down.