[CentOS] syslog / logstah problem with timestamp

Ralf Prengel

ralf.prengel at rprengel.de
Fri Mar 8 10:20:27 UTC 2019


Hallo,
I try to send my centos 7 logfiles to an logstsah server.
Can anyone give me an hint how to fix this problem?

Thanks

Ralf


> {"index"=>{"_index"=>"%{[@metadata][comline]}-%{[@metadata][version]}",  
> "_type"=>"doc", "_id"=>"U1XLXGkBpfl5FoHeY4J8", "status"=>400,  
> "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to  
> parse field [timestamp] of type [date]",  
> "caused_by"=>{"type"=>"illegal_argument_exception",  
> "reason"=>"Invalid format: \"Mar  8 11:13:54\""}}}}}
[2019-03-08T11:13:47,125][WARN ][logstash.outputs.elasticsearch] Could  
not index event to Elasticsearch. {:status=>400, :action=>["index",  
{:_id=>nil,  
:_index=>"%{[@metadata][comline]}-%{[@metadata][version]}",  
:_type=>"doc", :routing=>nil}, #<LogStash::Event:0x3af3f839>],  
:response=>{"index"=>{"_index"=>"%{[@metadata][comline]}-%{[@metadata][version]}", "_type"=>"doc", "_id"=>"VFXLXGkBpfl5FoHeY4Ly", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [timestamp] of type [date]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"Mar  8  
11:13:54\""}}}}}
[2019-03-08T11:13:47,202][WARN ][logstash.outputs.elasticsearch] Could  
not index event to Elasticsearch. {:status=>400, :action=>["index",  
{:_id=>nil,  
:_index=>"%{[@metadata][comline]}-%{[@metadata][version]}",  
:_type=>"doc", :routing=>nil}, #<LogStash::Event:0x4fedebdc>],  
:response=>{"index"=>{"_index"=>"%{[@metadata][comline]}-%{[@metadata][version]}", "_type"=>"doc", "_id"=>"VVXLXGkBpfl5FoHeZII_", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [timestamp] of type [date]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"Mar  8  
11:13:54\""}}}}}
^C




More information about the CentOS mailing list