我在template里面已经设置了dd/MM/yyyy:HH:mm:ss Z的format，但是存储的时候还是报错。
"timestamp": {
"format": "dd/MM/yyyy:HH:mm:ss Z||yyyy-MM-dd||epoch_millis",
"type": "date"
}
报错如下：
[2017-08-16T14:08:19,989][WARN ][logstash.outputs.elasticsearch] Failed action. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"acc-log-2017-08-16", :_type=>"log", :_routing=>nil}, 2017-08-16T06:08:18.762Z %{host} %{message}], :response=>{"index"=>{"_index"=>"acc-log-2017-08-16", "_type"=>"log", "_id"=>"AV3pqDAPo2yXn8X7WchM", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [timestamp]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"16/Aug/2017:14:08:09 +0800\" is malformed at \"Aug/2017:14:08:09 +0800\""}}}}}
"timestamp": {
"format": "dd/MM/yyyy:HH:mm:ss Z||yyyy-MM-dd||epoch_millis",
"type": "date"
}
报错如下：
[2017-08-16T14:08:19,989][WARN ][logstash.outputs.elasticsearch] Failed action. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"acc-log-2017-08-16", :_type=>"log", :_routing=>nil}, 2017-08-16T06:08:18.762Z %{host} %{message}], :response=>{"index"=>{"_index"=>"acc-log-2017-08-16", "_type"=>"log", "_id"=>"AV3pqDAPo2yXn8X7WchM", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [timestamp]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"16/Aug/2017:14:08:09 +0800\" is malformed at \"Aug/2017:14:08:09 +0800\""}}}}}
1 个回复
xinfanwang
赞同来自:
16/08/2017:06:08:18 +0800 ? 按你的mapping定义，这样才是符合格式的时间串。