I have Oracle DB logs which have standard ISO8601 timestamp (yyyy-MM-ddTHH:mm:ss.SSSSSSZ).
I have date filter
match => [ "log_timestamp", "ISO8601" ]
But to the Elasticsearch are indexed only events between 00:00:00 and 09:59:59.
It looks like Elasticsearch "don't understand" timestamps beginning with 1 or 2.
- I have the problem with the only log. The other logs using the same date filter are indexed correctly.
- There are not any errors in Logstash and Elasticsearch logs
Hi @ddoroshenko perhaps provide several samples of the complete timestamp you're trying to convert and what the results are.
2022-06-05T05:46:21.358067+02:00 in log is converted to
2022-06-05T05:46:21.358 in Kibana
But something like
2022-06-05T23:46:21.358067+02:00 just dissappears and I don't see nothing in Kibana
I had a tag collision in a pipeline so it cause the problem.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.