# Problelm with parsing a timestamp field

**URL:** <https://community.graylog.org/t/problelm-with-parsing-a-timestamp-field/31027>\
**Category:** Graylog Central (peer support)\
**Tags:** timestamp\
**Created:** [December 22, 2023, 4:54pm UTC](https://community.graylog.org/t/problelm-with-parsing-a-timestamp-field/31027 "2023-12-22T16:54:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gdevelek](https://avatars.discourse-cdn.com/v4/letter/g/46a35a/32.png) [@gdevelek](https://community.graylog.org/u/gdevelek)\
**Post date:** [December 22, 2023, 4:54pm UTC](https://community.graylog.org/t/problelm-with-parsing-a-timestamp-field/31027/1 "2023-12-22T16:54:56Z")

</div>

**1. Describe your incident:**

I get a lot of errors like this:

> OpenSearchException[OpenSearch exception [type=mapper\_parsing\_exception, reason=**failed to parse field [\_message\_timestamp] of type [date]** in document with id ‘c58701c1-a0dd-11ee-a408-0242c0a8b007’. Preview of field’s value: ‘2023-12-22 15:21:24.336’]]; nested: OpenSearchException[OpenSearch exception [type=illegal\_argument\_exception, reason=failed to parse date field [2023-12-22 15:21:24.336] with format [strict\_date\_optional\_time||epoch\_millis]]]; nested: OpenSearchException[OpenSearch exception [type=date\_time\_parse\_exception, reason=Failed to parse with all enclosed parsers]];

**2. Describe your environment:**

- OS Information: Ubuntu and docker-compose. I’ll be of course happy to provide the YAML if needed. I’m not using any extractors.

- Package Version: v5.2, with OpenSearch v2.11.1

Yesterday when I started up this particular input after first migrating from Elasticsearch (where I had the exact same problem), I didn’t have this problem, and I thought that OpenSearch did the trick. Today I have it again. Perhaps it has something to do with the index mapping getting determined dynamically with the entry that happens to come first. I’m using daily indices, so int\_\_0 today, int\_\_1 tomorrow etc.

I noticed that yesterday’s index had that field as “keyword”, whereas in today’s index it was “date”. However for another index that doesn’t have this problem, it’s also “date”…

This problem has been going on for days, it has become a major headache and is ruining my Xmas mood ☹ . I have tried introducing a template but it made things worse.

I find it puzzling that a working setup is not readily available for Graylog+Kubernetes, it’s not like I’m trying something that no one has tried before, it’s such a common scenario…

My filebeat.yml looks like this:

> ```
> filebeat.inputs:
> - type: container
> paths:
> - /var/log/containers/*.log
> processors:
> - add_kubernetes_metadata:
> host: ${NODE_NAME}
> matchers:
> - logs_path:
> logs_path: "/var/log/containers/"
> - decode_json_fields:
> fields: ["message"]
> target: "_message"
> overwrite_keys: true
> add_error_key: true      
> - timestamp:
> field: _message_timestamp
> target_field: _message_timestamp
> layouts:
> - '2006-01-02 15:04:05.999'
> test:
> - '2023-12-18 15:16:35.781'
> - add_cloud_metadata:
> - add_host_metadata:
> output.logstash:
> hosts: ["10.65.82.185:5045"]
> 
> ```

---

<div class="post-metadata">

**Author:** ![ramindia](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ramindia/32/5085_2.png) [@ramindia](https://community.graylog.org/u/ramindia)\
**Post date:** [December 23, 2023, 3:29pm UTC](https://community.graylog.org/t/problelm-with-parsing-a-timestamp-field/31027/2 "2023-12-23T15:29:16Z")

</div>

> [@gdevelek](#):
>
> ailed to parse field [\_message\_timestamp] of type [date

check below thread help you

> [@Failed to parse date field](https://community.graylog.org/t/failed-to-parse-date-field/22411/3):
>
> Hey, thanks for your help! My input is GELF TCP, basically docker stderr forwarded by nxlog from the host. There were some random issues with docker logspout so we ended up with this arrangement. I don’t know if it would work better with Docker sending logs directly to Graylog with gelf but our Docker CE doesn’t support multiple drivers so that’s why we currently have this setup. I do have 1 extractor there which I believe is considered for the message as it contains string “alert” but it ha…

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [January 6, 2024, 3:29pm UTC](https://community.graylog.org/t/problelm-with-parsing-a-timestamp-field/31027/3 "2024-01-06T15:29:34Z")

</div>

Closed on January 6, 2024, 3:29pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.