# Regarding illegal\_argument\_exception and empty value **URL:** \ **Category:** Logstash\ **Created:** [June 21, 2019, 6:14pm UTC](https://discuss.elastic.co/t/regarding-illegal-argument-exception-and-empty-value/186922 "2019-06-21T18:14:11Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![leeyu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leeyu/32/48561_2.png) [@leeyu](https://discuss.elastic.co/u/leeyu)\ **Post date:** [June 21, 2019, 6:14pm UTC](https://discuss.elastic.co/t/regarding-illegal-argument-exception-and-empty-value/186922/1 "2019-06-21T18:14:11Z")
Hi all, I got many warning messages like this ``` [2019-06-21T10:34:01,663][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"cv_threat_event_all_201812", :_type=>"_doc", :routing=>nil}, #], :response=>{"index"=>{"_index"=>"cv_threat_event_all_201812", "_type"=>"_doc", "_id"=>"7tQae2sBhpHZbQ7dLP79", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [begin_time] of type [date] in document with id '7tQae2sBhpHZbQ7dLP79'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"failed to parse date field [HTTP] with format [EEE dd MMM yyyy HH:mm:ss z]", "caused_by"=>{"type"=>"date_time_parse_exception", "reason"=>"Text 'HTTP' could not be parsed at index 0"}}}}}} ``` Which indicate that it is trying to prase "HTTP" to type "date" which definitely won't work. So I look into the input csv file and realize that I have some missing value. The correct file should be the following. ``` timestamp,device_sn,action_id,app_id,app_name,begin_time Sat 01 Dec 2018 01:48:12 GMT,ABC111,1,15,HTTP,Sat 01 Dec 2018 01:46:20 GMT ``` but some of the files are missing the app\_name ``` Sat 01 Dec 2018 04:18:09 GMT,261030KSA2670697,6,0,,Sat 01 Dec 2018 04:17:20 GMT Sat 01 Dec 2018 18:58:03 GMT,261030KSA2670697,6,0,,Sat 01 Dec 2018 18:50:22 GMT ``` So I assume logstash takes in HTTP as begin\_time. Is there any way to resolve this? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 21, 2019, 7:05pm UTC](https://discuss.elastic.co/t/regarding-illegal-argument-exception-and-empty-value/186922/2 "2019-06-21T19:05:01Z")
If you are parsing that with a csv filter that should just result in ``` "app_name" => nil, ``` What do your filters look like? ---
**Author:** ![leeyu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leeyu/32/48561_2.png) [@leeyu](https://discuss.elastic.co/u/leeyu)\ **Post date:** [June 21, 2019, 7:38pm UTC](https://discuss.elastic.co/t/regarding-illegal-argument-exception-and-empty-value/186922/4 "2019-06-21T19:38:10Z")
Hi Badger, Here is my csv filter, ``` csv { autodetect_column_names => "true" autogenerate_column_names => "true" skip_header => "true" separator => "," } ``` Also for the index template, I have the date detection on. ``` "date_detection": true, "dynamic_date_formats": ["EEE dd MMM yyyy HH:mm:ss z"] ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 21, 2019, 7:46pm UTC](https://discuss.elastic.co/t/regarding-illegal-argument-exception-and-empty-value/186922/5 "2019-06-21T19:46:52Z")
Can you check using the [mapping](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-get-mapping.html) API whether you have just the 6 fields you expect? ---
**Author:** ![leeyu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leeyu/32/48561_2.png) [@leeyu](https://discuss.elastic.co/u/leeyu)\ **Post date:** [June 21, 2019, 7:58pm UTC](https://discuss.elastic.co/t/regarding-illegal-argument-exception-and-empty-value/186922/6 "2019-06-21T19:58:29Z")
Hi Badger, Actually, that file contains about 50 fields. And the begin\_time is mapped to date. Here is a part of the return from GET /cv\_threat\_event\_all\_201812/\_mapping ``` "app_name" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, "attack" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", "ignore_above" : 256 } } }, "begin_time" : { "type" : "date", "format" : "EEE dd MMM yyyy HH:mm:ss z" }, ``` Here is the part about attack in my logstash config file. ``` dissect { mapping => { "path" => "/%{}/%{attack}/%{month}-%{}/%{}/%{type}_%{}" } add_tag => ["%{type}"] } ``` We have many kinds of files in the same folder so we use tag to upload the data to the correct index according to the tag. Is the tag causing the trouble? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 21, 2019, 8:01pm UTC](https://discuss.elastic.co/t/regarding-illegal-argument-exception-and-empty-value/186922/7 "2019-06-21T20:01:24Z")
> [@leeyu](#): > > Is the tag causing the trouble? I don't think so. I suggest you set up a [DLQ](https://www.elastic.co/guide/en/logstash/current/dead-letter-queues.html) to capture the messages that are failing to get mapped. Then run them through a different pipeline and look at the raw message. Maybe they have an extra comma or something. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 19, 2019, 8:01pm UTC](https://discuss.elastic.co/t/regarding-illegal-argument-exception-and-empty-value/186922/8 "2019-07-19T20:01:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.