In 6.2.4, when I try to do a mutate+copy of @timestamp it blows up with a NullPointerException. Is there another way to do this?
input { generator { message => '2018/05/11 12:34:56' count => 1 } }
filter {
date { match => [ "message", "yyyy/MM/dd HH:mm:ss" ] }
mutate { copy => { "@timestamp" => "foo" } }
}
output { stdout { codec => rubydebug } }
The top of the stack trace looks like this:
Exception in thread "Ruby-0-Thread-14@[main]>worker0: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385" java.lang.NullPointerException
at org.logstash.ext.JrubyTimestampExtLibrary$RubyTimestamp.ruby_to_iso8601(JrubyTimestampExtLibrary.java:112)
at org.logstash.ext.JrubyTimestampExtLibrary$RubyTimestamp.ruby_inspect(JrubyTimestampExtLibrary.java:106)
at org.logstash.ext.JrubyTimestampExtLibrary$RubyTimestamp$INVOKER$i$0$0$ruby_inspect.call(JrubyTimestampExtLibrary$RubyTimestamp$INVOKER$i$0$0$ruby_inspect.gen)
at org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:318)
Replacing the rubydebug output with an elasticsearch output gets you "An unknown error occurred sending a bulk request to Elasticsearch" instead.