Mapper parsing exeption logstash

Elastic Stack Logstash
1

Hi I am receiving this error message. I have been searching for hours where the problem is but I cannot find it. Is there a method to finding exactly where the problem is occurring?

Mär 11 12:21:16 mon logstash[16980]: [2020-03-11T12:21:16,291][WARN ][logstash.outputs.elasticsearch][main] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"var_log-2020.03.11", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x6354a9d5>], :response=>{"index"=>{"_index"=>"var_log-2020.03.11", "_type"=>"_doc", "_id"=>"XdBTyXABRKnuFwD_yIyg", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [timestamp] of type [date] in document with id 'XdBTyXABRKnuFwD_yIyg'. Preview of field's value: '20200311 122115'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"failed to parse date field [20200311 122115] with format [yyyy/MM/dd HH:mm:ss||yyyy/MM/dd||epoch_millis]", "caused_by"=>{"type"=>"date_time_parse_exception", "reason"=>"Failed to parse with all enclosed parsers"}}}}}}

2

Update:

I notice in the kibana index mapping json output I have this in one of the indexes:

 "timestamp": {
          "type": "date",
          "format": "yyyy/MM/dd HH:mm:ss||yyyy/MM/dd||epoch_millis"
        }

How can I remove this because on previous days the entry does not exist.

3

What did the mapping look like previously?

4

This entry was not there

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.