Unable to remove "timestamp" field (not "@timestamp"!)

Elastic Stack Logstash
1

I am seeing the error below in logstash log. So I'm trying to parse the string further but
after that mutate { remove_field => [ "timestamp" ] } does NOTHING. WTF?

"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [timestamp] of type [date] in document with id 'K8tEU3sBYHAq_1SEiyW_'. Preview of field's value: 'I 2021-08-17 08:40:05.186 SingleUserNotebookApp log:181'", "caused_by"=>{
"type"=>"illegal_argument_exception", "reason"=>"failed to parse date field [I 2021-08-17 08:40:05.186 SingleUserNotebookApp log:181] with format [strict_date_optional_time||epoch_millis]", "caused_by"=>{"type"=>"date_time_parse_exception", "reason"=>"Failed to parse wit
h all enclosed parsers"}}}
2

Impossible to say without seeing the whole filter configuration. Maybe [timestamp] is getting added again after it is removed. Maybe the mutate is inside a conditional and not getting executed. No way to say.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.