# LogStash::Json::GeneratorError when using mutate copy @timestamp **URL:** \ **Category:** Logstash\ **Created:** [February 9, 2018, 2:37pm UTC](https://discuss.elastic.co/t/logstash-json-generatorerror-when-using-mutate-copy-timestamp/119256 "2018-02-09T14:37:13Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![timvisher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timvisher/32/26257_2.png) [@timvisher](https://discuss.elastic.co/u/timvisher)\ **Post date:** [February 9, 2018, 2:37pm UTC](https://discuss.elastic.co/t/logstash-json-generatorerror-when-using-mutate-copy-timestamp/119256/1 "2018-02-09T14:37:14Z")
I was attempting to save off the timestamp that logstash saw an event before mutating the event to use the event's parsed timestamp with the date filter. My first attempt was: ```auto if [@timestamp] { mutate { copy => { "[@timestamp]" => "[logstash_timestamp]" } } } ``` Which resulted in the following error being logged contiuously. ```auto [2018-02-09T13:59:53,412][ERROR][logstash.outputs.elasticsearch] An unknown error occurred sending a bulk request to Elasticsearch. We will retry indefinitely {:error_message=>"", :error_class=>"LogStash::Json::GeneratorError", :b acktrace=>["/usr/share/logstash/logstash-core/lib/logstash/json.rb:52:in `jruby_dump'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:115:in `block in bulk'", "org/jruby/RubyArray.java:2486:in `map'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:115:in `block in bulk'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:113:in `bulk'", "/usr/share/logstash/v endor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.2-java/lib/logstash/outputs/elasticsearch/common.rb:232:in `safe_bulk'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.2-java/ lib/logstash/outputs/elasticsearch/common.rb:118:in `submit'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.2-java/lib/logstash/outputs/elasticsearch/common.rb:86:in `retrying_submit'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.0.2-java/lib/logstash/outputs/elasticsearch/common.rb:34:in `multi_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator_strate gies/shared.rb:13:in `multi_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator.rb:49:in `multi_receive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:538:in `block in output_batch'", "org/j ruby/RubyHash.java:1343:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:536:in `output_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:481:in `worker_loop'", "/usr/share/logstash/logsta sh-core/lib/logstash/pipeline.rb:439:in `block in start_workers'"]} ``` To fix it, I changed the config to: ```auto if [@timestamp] { mutate { add_field => { "logstash_timestamp" => "%{@timestamp}" } } } ``` This is in logstash 6.0.1 with the elasticsearch output plugin 9.0.2. On the advice of Xylakant from #logstash@freenode I'm opening this discussion. I don't have time to provide a minimal reproduction config but I might be able to later. See the full conversation between us below. * * * ```auto i would like to save the timestamp that logstash saw an event at in the event and then utilize the date filter to set @timestamp to the date from the event. i have the date filter working but my initial attempt to using a mutate filter to `{ copy => { "[@timestamp]" => "logstash_timestamp" } }` looks like it's generating json generator errors. anything clever i should be aware of? [09:02] yeah. remoeving that mutate filter and the json errors go away [09:03] i'd try mutate {add_field => { "logstash_timestamp" => "@timestamp"} or something along those lines [09:04] the timestamp field is somewhat special since it's a date ah for further context the json error is coming from the elasticsearch output plugin 9.0.2 [09:05] i'll try that i'm currently hiding the copy behind an if statement. is there any reason to have the if statement? or can i rely on @timestamp always being set? err, interpolation for the @timestamp, so "%{timestamp}" obviously @timestamp is always set, if there's no timestamp set when logstash sees the document, it will add one [09:06] obviously "%{@timestamp}" actually i don't follow that last statement. oh ok narf, you get the meaning now i do :) heh the json error produced would be interesting [09:08] let me see if i can paste it somewhere I don't see a particular reason copy should cause this a gist or pastebin will do https://gist.github.com/timvisher/f56e83eae1f4005c4b0b966edcf40816 [09:09] that's pretty devoid of real information :( [09:11] what logstash version is that? [09:12] 6.0.1 [09:17] is there something better i can turn on as far as logging? fwiw the add_field version worked fine [09:18] i think you could raise a ticket against logstash core, that's a problem in logstashs json generator [09:20] i don't think there's much you could turn on in terms of logging ok. the error is triggered here https://github.com/elastic/logstash/blob/master/logstash-core/lib/logstash/json.rb#L28 and the code is straightforward dump into json generator [09:21] the trace says line 52, but that line number changed somewhere between master and 6.0 [09:22] ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 9, 2018, 2:37pm UTC](https://discuss.elastic.co/t/logstash-json-generatorerror-when-using-mutate-copy-timestamp/119256/2 "2018-03-09T14:37:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.