Hello,
I am investigating the reason for ES to raise some exceptions while
processing data shipped by Logstash, and something doesn't make sense. The
software is running on Windows machines, and the log file is a JSON
document with dateTime fields formatted using invariant culture. Here's an
example of a dateTime value:
"ModifiedDate":"2014/11/25 10:22:47.9200 +01:00"
In ES log I see that this JSON caused an exception. Elasticsearch complains
about parsing ModifiedDate, and it prints the value:
"ModifiedDate":"2014.11.25 10:22:49.2100 +01:00"
Note that date separators changed! Apparently they now correspond to
machine UI culture, but shouldn't ES use the value as is, without
reformatting. Also if the date was reformatted it means that ES managed
somehow to recognized it as a date, then parse, re-format and only then
suddenly complain about it not being a good date, here is the message:
IllegalArgumentException: Invalid format: "2014.11.25 10:22:47.9200 +01:00"
is malformed at ".11.25 10:22:47.9200 +01:00", so it rejected the date
separator.
Does anyone know what could be a reason for such behavior?
Thanks in advance.
Vagif
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/278b0474-097a-41ef-8291-5ea10abb7b75%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
Ooops, sorry about that. Spent some more time and found that the offensive
message comes from a different server where it was in fact incorrectly
formatted. Please disregards the question.
Vagif
On Tuesday, November 25, 2014 12:04:08 PM UTC+1, Vagif Abilov wrote:
Hello,
I am investigating the reason for ES to raise some exceptions while
processing data shipped by Logstash, and something doesn't make sense. The
software is running on Windows machines, and the log file is a JSON
document with dateTime fields formatted using invariant culture. Here's an
example of a dateTime value:
"ModifiedDate":"2014/11/25 10:22:47.9200 +01:00"
In ES log I see that this JSON caused an exception. Elasticsearch
complains about parsing ModifiedDate, and it prints the value:
"ModifiedDate":"2014.11.25 10:22:49.2100 +01:00"
Note that date separators changed! Apparently they now correspond to
machine UI culture, but shouldn't ES use the value as is, without
reformatting. Also if the date was reformatted it means that ES managed
somehow to recognized it as a date, then parse, re-format and only then
suddenly complain about it not being a good date, here is the message:
IllegalArgumentException: Invalid format: "2014.11.25 10:22:47.9200
+01:00" is malformed at ".11.25 10:22:47.9200 +01:00", so it rejected the
date separator.
Does anyone know what could be a reason for such behavior?
Thanks in advance.
Vagif
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/56125dc0-d87f-49af-9c9d-0ed3114c9735%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.