Rollup fails with: ElasticsearchParseException: failed to parse date field [0] with format [date_time]

Elastic Stack Elasticsearch
1

We are using the RollUp API to process tomcat access logs. The logs have a "timestamp" field formatted as follows (mapping):
"timestamp": {
"type": "date",
"format": "date_time"
}

The Rollup fails with the following message:

ElasticsearchParseException: failed to parse date field [0] with format [date_time]

We don't have any other problems with the field timestamp (e.g. in Kibana).

[2018-08-20T08:32:00,021][WARN ][o.e.x.r.j.RollupJobTask  ] Rollup job [accessPerformance5] failed with an exception: 
    org.elasticsearch.action.search.SearchPhaseExecutionException: all shards failed
        at org.elasticsearch.action.search.AbstractSearchAsyncAction.onPhaseFailure(AbstractSearchAsyncAction.java:288) ~[elasticsearch-6.3.1.jar:6.3.1]
        at org.elasticsearch.action.search.AbstractSearchAsyncAction.executeNextPhase(AbstractSearchAsyncAction.java:128) ~[elasticsearch-6.3.1.jar:6.3.1]
        at org.elasticsearch.action.search.AbstractSearchAsyncAction.onPhaseDone(AbstractSearchAsyncAction.java:249) ~[elasticsearch-6.3.1.jar:6.3.1]
    ...
        at java.lang.Thread.run(Thread.java:745) [?:1.8.0_45]
    Caused by: org.elasticsearch.ElasticsearchParseException: failed to parse date field [0] with format [date_time]
        at org.elasticsearch.common.joda.DateMathParser.parseDateTime(DateMathParser.java:213) ~[elasticsearch-6.3.1.jar:6.3.1]
        at org.elasticsearch.common.joda.DateMathParser.parse(DateMathParser.java:66) ~[elasticsearch-6.3.1.jar:6.3.1]
        at org.elasticsearch.index.mapper.DateFieldMapper$DateFieldType.parseToMilliseconds(DateFieldMapper.java:318) ~[elasticsearch-6.3.1.jar:6.3.1]
        at org.elasticsearch.index.mapper.DateFieldMapper$DateFieldType.isFieldWithinQuery(DateFieldMapper.java:331) ~[elasticsearch-6.3.1.jar:6.3.1]
    ...
        at org.elasticsearch.search.SearchService$2.onResponse(SearchService.java:333) ~[elasticsearch-6.3.1.jar:6.3.1]
2

@cawoodm Hmm, I'm not sure off the top of my head. Could you open an issue on Github with the full stack trace (if available) and your rollup config? It'll be easier to track this on github than on the forums.

It might be related to this bug (https://github.com/elastic/elasticsearch/pull/31890) but I'm not positive.

3

Done:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.