elastic / elastic/logstash

Timestamp parsing fails with "cannot convert instance of class org.jruby.RubyObject to class java.lang.String"

Open
#3,785 13 comments 0 reactions 0 assignees View on GitHub
unconfirmed
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
19h 14m
Merged PRs (30d)
63

Description

Hi, using the logstash package on debian wheezy with the following versions:
logstash 1.5.4-1
openjdk-7-jre-headless:amd64 7u79-2.5.6-1~deb7u1

I'm getting the following message:

```
{:timestamp=>"2015-08-25T14:25:17.945000+1000", :message=>"Failed parsing date from field", :field=>"timestamp", :value=>"2015-08-25T04:25:17.000Z", :exception=>"cannot convert instance of class org.jruby.RubyObject to class java.lang.String", :config_parsers=>"yyyy-MM-dd HH:mm:ss.SSS,yyyy-MM-dd HH:mm:ss,SSS,yyyy-MM-dd HH:mm:ss,yyyy/MM/dd HH:mm:ss,MMM d HH:mm:ss,MMM dd HH:mm:ss,dd/MMM/yyyy:HH:mm:ss Z,yyyy-MM-dd HH:mm:ss.SSSZ,yyyy-MM-dd'T'HH:mm:ss.SSSZ,yyyy-MM-dd'T'HH:mm:ssZ,E MMM dd HH:mm:ss yyyy Z", :config_locale=>"default=en_AU", :level=>:warn}
```

At this point I'm not quite sure what's causing it.
I'm suspecting the following tidbit in the config but cannot be certain (namely the _target_ part):

```
date {
match => ["timestamp",
"yyyy-MM-dd HH:mm:ss.SSS",
"yyyy-MM-dd HH:mm:ss,SSS",
"yyyy-MM-dd HH:mm:ss",
"yyyy/MM/dd HH:mm:ss",
"MMM d HH:mm:ss",
"MMM dd HH:mm:ss",
"dd/MMM/yyyy:HH:mm:ss Z",
"yyyy-MM-dd HH:mm:ss.SSSZ",
"yyyy-MM-dd'T'HH:mm:ss.SSSZ",
"yyyy-MM-dd'T'HH:mm:ssZ",
"E MMM dd HH:mm:ss yyyy Z"
]
target => "timestamp"
timezone => 'Australia/Melbourne'
}
```

Any ideas?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.