# @timestamp format string error

**URL:** <https://discuss.elastic.co/t/timestamp-format-string-error/83562>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 25, 2017, 11:59am UTC](https://discuss.elastic.co/t/timestamp-format-string-error/83562 "2017-04-25T11:59:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![xuhaibo](https://avatars.discourse-cdn.com/v4/letter/x/34f0e0/32.png) [@xuhaibo](https://discuss.elastic.co/u/xuhaibo)\
**Post date:** [April 25, 2017, 11:59am UTC](https://discuss.elastic.co/t/timestamp-format-string-error/83562/1 "2017-04-25T11:59:04Z")

</div>

my kafka config is

```
output.kafka:
# Boolean flag to enable or disable the output module.
  enabled: true
  codec.format: 
     string: ' %{[@timestamp]} ' 

```

When start reading the nginx log.  
It will appear this error

```auto
2017/04/25 11:05:12.569834 formatevents.go:409: WARN Can not convert key '{63628715107 562862910 0xd425c0}' value to string
2017/04/25 11:05:12.569873 format.go:42: ERR Fail to format event (can not convert to string): common.MapStr{"input_type":"log", "message":"127.0.0.1 - - [25/Apr/2017:19:05:04 +0800] \"GET /update_ban_dict HTTP/1.1\" 200 5 \"-\" \"curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.19.1 Basic ECC zlib/1.2.8 libidn/1.18 libssh2/1.4.2\" \"-\" \"wangbin.test\" \"8360\" 0.000 \"-\"", "beat":common.MapStr{"name":"dev03.test.com", "hostname":"dev03.test.com", "version":"5.3.1"}, "@timestamp":common.Time{sec:63628715107, nsec:562862910, loc:(*time.Location)(0xd425c0)}, "source":"/data/logs/nginx/wangbin.test/201704/25/access_19.log", "offset":1428, "type":"nginx_log"}
2017/04/25 11:05:12.569883 client.go:123: ERR Dropping event: can not convert to string

```

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 26, 2017, 2:13pm UTC](https://discuss.elastic.co/t/timestamp-format-string-error/83562/2 "2017-04-26T14:13:15Z")

</div>

This looks like a bug to me. I couldn't reproduce with the [snapshot release](https://beats-nightlies.s3.amazonaws.com/index.html?prefix=filebeat/) from master so maybe it was fixed in master.

Let's see if @steffens is familiar with this issue.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [April 26, 2017, 3:00pm UTC](https://discuss.elastic.co/t/timestamp-format-string-error/83562/3 "2017-04-26T15:00:12Z")

</div>

Problem is, the `@timestamp` field is not readable from `codec.format.string`. It's currently fixed in master by this [PR](https://github.com/elastic/beats/pull/3721).

---

<div class="post-metadata">

**Author:** ![xuhaibo](https://avatars.discourse-cdn.com/v4/letter/x/34f0e0/32.png) [@xuhaibo](https://discuss.elastic.co/u/xuhaibo)\
**Post date:** [April 27, 2017, 3:49am UTC](https://discuss.elastic.co/t/timestamp-format-string-error/83562/4 "2017-04-27T03:49:27Z")

</div>

Yes, in the master version has been repaired this problem. I downloaded the source code compiled and found that there is no such problem

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 25, 2017, 4:03am UTC](https://discuss.elastic.co/t/timestamp-format-string-error/83562/5 "2017-05-25T04:03:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.