Need a little help with this one. Tried doing as the deprecation log states, but logstash crashes on restart.
The full deprecation log message is:
'y' year should be replaced with 'u'. Use 'y' for year-of-era. Prefix your date format with '8' to use the new specifier.
Working logstash config in 6.8:
date {
locale => "en"
match => ["logTimestamphttp", "dd/MMM/yyyy:HH:mm:ss Z"]
timezone => "America/New_York"
target => "logTimestamp"
}
date {
locale => "en"
match => ["logTimestampString", "YYYY-MM-dd;HH:mm:ss.SSS"]
timezone => "America/New_York"
target => "logTimestamp"
}
Config changes I've made listed here with the result:
-This results in no logs reaching my existing indexes after restarting logstash.
date {
locale => "en"
match => ["logTimestamphttp", "dd/MMM/8yyyy:HH:mm:ss Z"]
timezone => "America/New_York"
target => "logTimestamp"
}
date {
locale => "en"
match => ["logTimestampString", "8yyyy-MM-dd;HH:mm:ss.SSS"]
timezone => "America/New_York"
target => "logTimestamp"
}
-This results in logstash not restarting.
date {
locale => "en"
match => ["logTimestamphttp", "dd/MMM/8uuuu:HH:mm:ss Z"]
timezone => "America/New_York"
target => "logTimestamp"
}
date {
locale => "en"
match => ["logTimestampString", "8uuuu-MM-dd;HH:mm:ss.SSS"]
timezone => "America/New_York"
target => "logTimestamp"
}
-So, I start thinking, "oh! prefix the date! I'll move the 8 to the beginning of the whole date!" Again, this results in no logs reaching my existing indexes after restarting logstash.
date {
locale => "en"
match => ["logTimestamphttp", "8dd/MMM/yyyy:HH:mm:ss Z"]
timezone => "America/New_York"
target => "logTimestamp"
}
date {
locale => "en"
match => ["logTimestampString", "8yyyy-MM-dd;HH:mm:ss.SSS"]
timezone => "America/New_York"
target => "logTimestamp"
}
-"Okay, maybe I need to use the 'u' like the message says in the deprecation log". Still logstash crashes on restart.
date {
locale => "en"
match => ["logTimestamphttp", "8dd/MMM/uuuu:HH:mm:ss Z"]
timezone => "America/New_York"
target => "logTimestamp"
}
date {
locale => "en"
match => ["logTimestampString", "8uuuu-MM-dd;HH:mm:ss.SSS"]
timezone => "America/New_York"
target => "logTimestamp"
}
[2019-07-17T14:23:19,603][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"Java::JavaLang::IllegalArgumentException", :message=>"Illegal pattern component: uuuu", :backtrace=>["org.joda.time.format.DateTimeFormat.parsePatternTo(org/joda/time/format/DateTimeFormat.java:566)", "org.joda.time.format.DateTimeFormat.createFormatterForPattern(org/joda/time/format/DateTimeFormat.java:687)", ...
What do I need to change in order for this move to 7.x handle my dates properly?