Timestamp extractor error

Graylog Central (peer support)
1

Capture
Capture1263×768 55.8 KB

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:

Capture
Capture1370×136 13.6 KB

I try to add timestamp extractor on input in Graylog 4.2.1+5442e44 but get :

gl2_processing_error:
Value <16.12.21 19:14:01.687> caused exception: Invalid format: “16.12.21 19:14:01.687” is malformed at “.12.21 19:14:01.687”.
look like date format is bad ??

  1. for extractor use split and this is Extractor preview : 16.12.21 19:14:01.768 for example
  2. add - Convert to date type
  3. Format string : dd.MM.yy HH:mm:ss.SSS

I used same extractor on same input in Graylog 2.4.3 and it was OK

2. Describe your environment:

  • OS Information:
    Kernel: Linux 3.10.0-693.el7.x86_64

  • Package Version:
    Graylog 4.2.1+5442e44
    elasticsearch-7.13.4-x86_64

  • Service logs, configurations, and environment variables:

3. What steps have you already taken to try and solve the problem?
when i save extractor as different filed name it is success and no error and value present as date.
maybe elasticsearch need something extra fore timestamp field ?

4. How can the community help?

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

2

Hello

From the looks of your screenshot this post looks something familiar to yours.

Sorry about that, but some things have change.

Hope that helps

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.