-1

i see this warning in filebeat logs:

2022-11-08T15:24:21.094Z        ERROR   [jsonhelper]    jsontransform/jsonhelper.go:62  JSON: Won't overwrite @timestamp because of parsing error: parsing time "2022-11-07T14:43:53.815430" as "2006-01-02T15:04:05Z07:00": cannot parse "" as "Z07:00"
2022-11-08T15:24:21.094Z        ERROR   [jsonhelper]    jsontransform/jsonhelper.go:62  JSON: Won't overwrite @timestamp because of parsing error: parsing time "2022-11-07T14:43:58.787702" as "2006-01-02T15:04:05Z07:00": cannot parse "" as "Z07:00"
2022-11-08T15:24:21.094Z        ERROR   [jsonhelper]    jsontransform/jsonhelper.go:62  JSON: Won't overwrite @timestamp because of parsing error: parsing time "2022-11-07T14:44:03.795769" as "2006-01-02T15:04:05Z07:00": cannot parse "" as "Z07:00"
2022-11-08T15:24:21.094Z        ERROR   [jsonhelper]    jsontransform/jsonhelper.go:62  JSON: Won't overwrite @timestamp because of parsing error: parsing time "2022-11-07T14:44:03.861020" as "2006-01-02T15:04:05Z07:00": cannot parse "" as "Z07:00"
2022-11-08T15:24:21.094Z        ERROR   [jsonhelper]    jsontransform/jsonhelper.go:62  JSON: Won't overwrite @timestamp because of parsing error: parsing time "2022-11-07T14:44:06.037150" as "2006-01-02T15:04:05Z07:00": cannot parse "" as "Z07:00"

filebeat.inputs:
- type: log
  json.keys_under_root: true
  json.overwrite_keys: true
  fields_under_root: true
  fields: {
    application: app01
  }
  paths:
    - "/var/log/app01/*.log"
  ignore_older: 48h

I’m using Python’s "loggin" library.

Is there any way to correct this through filebeat?

Thanks for the help.

Regards,

Emanuel
  • 23
  • 6

1 Answers1

1

There is the filebeat Timestamp processor that can be used to better format or overwrite the @timestamp field. https://www.elastic.co/guide/en/beats/filebeat/current/processor-timestamp.html

Mike R
  • 464
  • 5
  • 16