Problem with indexing event their time in timestamp beginning with no zero


I have Oracle DB logs which have standard ISO8601 timestamp (yyyy-MM-ddTHH:mm:ss.SSSSSSZ).

I have date filter

filter {
  date {
    match => [ "log_timestamp", "ISO8601" ]

But to the Elasticsearch are indexed only events between 00:00:00 and 09:59:59.
It looks like Elasticsearch "don't understand" timestamps beginning with 1 or 2.


  1. I have the problem with the only log. The other logs using the same date filter are indexed correctly.
  2. There are not any errors in Logstash and Elasticsearch logs

Hi @ddoroshenko perhaps provide several samples of the complete timestamp you're trying to convert and what the results are.

Here are.
The 2022-06-05T05:46:21.358067+02:00 in log is converted to 2022-06-05T05:46:21.358 in Kibana

But something like 2022-06-05T15:46:21.358067+02:00 or 2022-06-05T23:46:21.358067+02:00 just dissappears and I don't see nothing in Kibana

I had a tag collision in a pipeline so it cause the problem.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.