Logstash log waring,how can i do?

Elastic Stack Logstash
1

hi,all

i have this log

172.16.36.144 - - [19/May/2016:10:32:43 +0800] "GET /seeyon/meetingroom.do?method=checkMeetingRoomIsZY&startDate=2016-05-20%2010:15&endDate=2016-05-20%2013:00&roomId=-5456742528427275524&date=Thu%20May%2019%202016%2010:32:47%20GMT+0800%20(%E4%B8%AD%E5%9B%BD%E6%A0%87%E5%87%86%E6%97%B6%E9%97%B4) HTTP/1.1" 200 3

and my logstash say

"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [url_startDate]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: "2016-05-20%2010:15" is malformed at "%2010:15""}}}}, :level=>:warn}

seem's like the URI parse startDate error.

the uri startDate that startDate=2016-05-20%2010:15&endDate=2016-05-20%2013:00

%20 can not parse?

my logstash configure like this

  if [URI] {

            ruby {
                init => "@kname = ['url_path','url_args']"
                code => "event.append(Hash[@kname.zip(event['URI'].split('?'))])"
            }

                kv {
                        prefix => "url_"
                        source => "url_args"
                        field_split => "& "
                        remove_field => [ "url_args","uri","request" ]
            }
}
2

Perhaps you should use the urldecode filter to process the start date and turn %20 into a space?

3

i will try it.