Panic when using json overwrite_keys option and elasticsearch output

(Jeffrey Earl) #1

I'm testing the new json support in filebeat 5.0.0-alpha1. I'm having an issue sending json output to elasticsearch with the overwrite_keys option. If overwrite_keys is enabled, the filebeat process crashes. Debug output indicates "panic: interface conversion: interface is string, not common.Time". The source timestamp in my test log entry is "2016-04-05T18:47:18.444Z", which seems to be in the proper format. Both logstash and local file outputs work as expected under the same conditions with the same log. If I disable overwrite_keys, logs are properly sent to elasticsearch. I'm testing on Centos 6.7 64-bit.

(Andrew Kroh) #2

Thanks for reporting, please open a new issue for this and attach a stack trace if you have one.

(system) #3