Mapping for 12h date format


(chrisinho) #1

Hi,

i have a log format with a timestamp like this :
Dez 08, 2016 8:17:29 AM

I use a custom grok pattern for it in logstash.
When i want elasticsearch to map it i get a mapper_parsing_exception.
It says invalid format.
How can i fix it?

My template looks like this:

"timestamp": {
"index": "not_analyzed",
"type": "date",
"format": "yyyy-MM-dd HH:mm:ss,SSS||yyyy-MM-dd HH:mm:ss||MMM dd, yyyy HH:mm:ss a",
"doc_values": true
}


(Colin Goodheart-Smithe) #2

In the example above you have Dez as the month? Is this a typo or are you using a non-english locale?


(Colin Goodheart-Smithe) #3

If you are using a non-english locale you may need to add the localeoption to the date field mapping to indicate the locale of the dates in your documents.


(chrisinho) #4

Thanks! With the locale Option it works


(Colin Goodheart-Smithe) #5

I'm curious what locale you are using?


(chrisinho) #6

For the given example log it is a german locale

Dez for Dezember


(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.