SimonMo  
                (SimonMo)
               
                 
              
                  
                    February 15, 2013, 11:17am
                   
                   
              1 
               
             
            
              Hi,
i try to store my log4j messages in ES.
log4j -> flume -> ES
So in flume i use a regex_extractor to write the timestamp in a field 
called 'timestamp'
timestamp = "2013-02-15T12:01:37.089+01"
Now i want to use this field in ES:
"_timestamp" : { 
"enabled" : true, 
"format" : "yyyy-MM-ddTHH:mm:ss.SSSZ" 
}
i also try to set the date_format to date_hour_minute_second_millis but i 
always get
"java.lang.NumberFormatException: For input string: 
"2013-02-15T12:01:37.089+01""
Can anybody help me to solve this problem?
Regards, 
Simon
-- 
You received this message because you are subscribed to the Google Groups "elasticsearch" group. 
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com . 
For more options, visit https://groups.google.com/groups/opt_out .
             
            
               
               
               
            
            
           
          
            
              
                drewr  
                (Drew Raines)
               
              
                  
                    February 15, 2013,  2:51pm
                   
                   
              2 
               
             
            
              Simon Monecke wrote:
timestamp = "2013-02-15T12:01:37.089+01"
Now i want to use this field in ES:
"_timestamp" : { 
"enabled" : true, 
"format" : "yyyy-MM-ddTHH:mm:ss.SSSZ" 
}
i also try to set the date_format to date_hour_minute_second_millis but i 
always get
"java.lang.NumberFormatException: For input string: 
"2013-02-15T12:01:37.089+01""
Can anybody help me to solve this problem?
 
The default "dateOptionalTime" format parses your timestamp 
successfully.
"2013-02-15T12:01:37.089+01" --> 1360926097089
Start off with no mapping and build up from there.  ES has very 
sensible defaults.  It's better to throw data at ES and only fix what 
doesn't work.
-Drew
-- 
You received this message because you are subscribed to the Google Groups "elasticsearch" group. 
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com . 
For more options, visit https://groups.google.com/groups/opt_out .