Using timestamp processor fails

Elastic Stack Beats
1

Hi,

I have logs that are JSON, and I'm trying to set the @timestamp field based on that.

The format is:

2020-04-16 05:45:51,913

with timezone as 'America/Los_Angeles'

I have set this configuration

processors:
- timestamp:
    field: event_date_pst
    timezone: 'America/Los_Angeles'
    layouts:
      - '2006-01-02 15:04:05,000'
    test:
      - '2020-04-16 05:45:51,913'
      - '2020-04-30 20:45:52,000'
      - '2020-12-31 20:45:52,080'

but when testing it, fails:

filebeat -e -d "*" test config
 
2020-04-16T07:47:17.381-0700	DEBUG	[processor.timestamp]	timestamp/timestamp.go:173	Failure parsing time field.	{"error": "failed parsing time field event_date_pst='2020-04-16 05:45:51,913'", "errorCauses": [{"error": "failed using layout [2006-01-02 15:04:05,000] cannot parse [913] as [,000]"}]}

The thing is that if I change the comma by a dot in the layout and the tests, it works, but it does not with the comma.

Am I missing something? or it is because this?

Thanks!

2

You didn't miss anything, this is a confirmed, known issue: https://github.com/elastic/beats/issues/15012

Go accepts milliseconds only with "." (dot).

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.