Logstash parses log fine, elasticsearch throws date error?


#1

Log: 2016-11-19 05:15:34.537 [INFO ] [15722:119885] Blah blah blah

Date Config:

date {
match => [ "timestamp" , "yyyy-MM-dd HH:mm:ss.SSS" ]
timezone => 'UTC'
locale => 'en'
}

Error: {:timestamp=>"2016-11-19T05:16:05.983000+0000", :message=>"Failed parsing date from field", :field=>"timestamp", :value=>"2016-11-19 05:15:34.537", :exc
eption=>"Invalid format: "2016-11-19 05:15:34.537" is malformed at ".537"", :config_parsers=>"yyyy-MM-dd HH:mm:ss Z", :config_locale=>"en", :level=>
:warn}

This is only thrown when pushed into elasticsearch, but when I run the configuration manually (bin/logstash -f config) it parses just fine.

Any ideas ?


#2

Looks like it had to do with a date block outside of a filter block in another configuration which must of been getting applied AFTER the configuration here said it was good.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.