Wrong argument type string expected Timestamp

Greetings,

I have seen other similar threads to this but not able to solve my problem, I am getting the error:

[2020-01-22T10:45:38,409][WARN ][logstash.inputs.gelf ] Gelf (tcp): client socket failed. {:exception=>#<TypeError: wrong argument type String (expected LogStash::Timestamp)>, :backtrace=>["org/logstash/ext/JrubyEventExtLibrary.java:95:in set'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-gelf-3.2.0/lib/logstash/inputs/gelf.rb:281:in block in strip_leading_underscore'", "org/jruby/RubyArray.java:1792:in each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-gelf-3.2.0/lib/logstash/inputs/gelf.rb:279:in strip_leading_underscore'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-gelf-3.2.0/lib/logstash/inputs/gelf.rb:161:in `block in tcp_listener'"]}

When I turn off the winlogbeats prefix to send in GELF format. So before the fields it is sending look like this:

WITH PREFIX (works)

timestamp":1.579706245057E9
winlogbeat @timestamp":“2020-01-22T15:17:25.057Z
_timestamp”:"2020-01-22T15:17:25.057Z

WITHOUT PREFIX (doesn’t work)

timestamp":1.579703908066E9
_timestamp":“2020-01-22T14:38:28.066Z
_@timestamp”:"2020-01-22T14:38:28.066Z

How do I know which field is causing Logstash its issues and reference that field in order to correct it?

Many Thanks.

The code is removing the leading underscore from the fieldname. You appear to have a field called _@timestamp, so that would result in a field called @timestamp. I think logstash expect @timestamp to be a LogStash::Timestamp, not a string.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.