I'm getting the following error from Logstash:
{:timestamp=>"2013-12-30T17:05:01.968000-0800", :message=>"Failed parsing date from field", :field=>"message", :value=>"2013-12-30 17:04:59,539.539 INFO 14282:140418951137024 [foo.lib.base.onResults:152] -- /1.12/media - \"getMediaStoreUrl\": , 10.101.AA.BB, 10.101.19.254 took 0.170675992966, returning https://foo.s3.amazonaws.com/foo/customerMedia/1009238911/23883995/image?Signature=%2BfXqEdNWtWdhwzi%&*YEGJSDDdDFF%3D&Expires=1388455499&AWSAccessKeyId=NOIMNOTTHATSTUPID>, , >>>", :exception=>java.lang.IllegalArgumentException: Invalid format: "2013-12-30 17:04:59,539.539 INFO 14282:140418951137024..." is malformed at ".539 INFO 14282:140418951137024...", :level=>:warn}
The error is obviously about the date format, which comes to me as:
2013-12-30 17:04:59,539.539 INFO 14282:140418951137024...
And my pattern is as follows:
date {
match => ["message", "yyyy-MM-dd HH:mm:ss,SSS"]
}
I read up on the Joda-Time Library and I think I've got the format correct above. It's odd to me that the error message contains the doubled SSS (milliseconds) portion: ",539.539" (our logs output that way for some reason). I deliberately didn't put the second portion ".539" in my pattern because I want it ignored.
I am also successfully using the following pattern in another filter:
(?<pylonsdate>%{DATESTAMP}\.[0-9]+)
I'm just not exactly sure where this error is coming from. Any ideas what I need to do to correct this? Do I need to mutate @timestamp? Any help is appreciated!