Hi All,
I was going through trying to find something relevant to the issue I am experiencing however I have been unable to locate one to my specific use case-I was hoping for some guidance here as this is one I have not experienced before.
When sending logs from logstash to ES AFTER creating an index template (as I need specific fields mapped), I am unable to generate an index pattern. (indexes do get created in Index Management though but no pattern) Upon further review of the ES logs, I am seeing this error-
<org.elasticsearch.index.mapper.MapperParsingException: failed to parse field [@timestamp] of type [date]> and when reviewing the actual records being parsed to ES, i see the @timestamp mapped properly in my template. Please let me know if you all need anymore information as I am kind of stumped as into what is happening here.
"@timestamp":"2019-03-28T18:12:36.000Z"
My template is copied below-
},
"mappings" : {
"doc" : {
"dynamic" : "true",
"dynamic_templates" : [
{
"base" : {
"match_mapping_type" : "string",
"mapping" : {
"fields" : {
"keyword" : {
"type" : "keyword"
}
},
"type" : "text"
}
}
}
],
"numeric_detection" : true,
"properties" : {
"@timestamp" : {
"type" : "date",
"format" : "yyyy-mm-dd"T"HH:mm:ss.SSSZ"
},