Problem with indexing event their time in timestamp beginning with no zero

[ddoroshenko (Dmitriy)]

Hi,

I have Oracle DB logs which have standard ISO8601 timestamp (yyyy-MM-ddTHH:mm:ss.SSSSSSZ).

I have date filter

filter {
  date {
    match => [ "log_timestamp", "ISO8601" ]
  }
}

But to the Elasticsearch are indexed only events between 00:00:00 and 09:59:59.
It looks like Elasticsearch "don't understand" timestamps beginning with 1 or 2.

Note:

1. I have the problem with the only log. The other logs using the same date filter are indexed correctly.
2. There are not any errors in Logstash and Elasticsearch logs

[stephenb (Stephen Brown)]

Hi @ddoroshenko perhaps provide several samples of the complete timestamp you're trying to convert and what the results are.

[ddoroshenko (Dmitriy)]

Here are.
The 2022-06-05T05:46:21.358067+02:00 in log is converted to 2022-06-05T05:46:21.358 in Kibana

But something like 2022-06-05T15:46:21.358067+02:00 or 2022-06-05T23:46:21.358067+02:00 just dissappears and I don't see nothing in Kibana

[ddoroshenko (Dmitriy)]

Well,
I had a tag collision in a pipeline so it cause the problem.