Timestamp extractor error

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:

I try to add timestamp extractor on input in Graylog 4.2.1+5442e44 but get :

Value <16.12.21 19:14:01.687> caused exception: Invalid format: “16.12.21 19:14:01.687” is malformed at “.12.21 19:14:01.687”.
look like date format is bad ??

  1. for extractor use split and this is Extractor preview : 16.12.21 19:14:01.768 for example
  2. add - Convert to date type
  3. Format string : dd.MM.yy HH:mm:ss.SSS

I used same extractor on same input in Graylog 2.4.3 and it was OK

2. Describe your environment:

  • OS Information:
    Kernel: Linux 3.10.0-693.el7.x86_64

  • Package Version:
    Graylog 4.2.1+5442e44

  • Service logs, configurations, and environment variables:

3. What steps have you already taken to try and solve the problem?
when i save extractor as different filed name it is success and no error and value present as date.
maybe elasticsearch need something extra fore timestamp field ?

4. How can the community help?

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]


From the looks of your screenshot this post looks something familiar to yours.

Sorry about that, but some things have change.

Hope that helps

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.