错误格式无效：[ISO8601] 在 ElasticSearch 中索引日志时

Question

当我尝试将我的日志索引到 ElasticSearch (1.3.4) 时，我看到了一个异常。我看到的异常的根本原因如下（编辑了我的初始 post 以提供完整的堆栈跟踪）

[2015-01-09 15:53:00,953][DEBUG][action.admin.indices.create] [perfgen04 1] [logaggr-2015.01.09] failed to create
org.elasticsearch.index.mapper.MapperParsingException: mapping [test]
    at org.elasticsearch.cluster.metadata.MetaDataCreateIndexService.execute(MetaDataCreateIndexService.java:386)
    at org.elasticsearch.cluster.service.InternalClusterService$UpdateTask.run(InternalClusterService.java:328)
    at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.run(PrioritizedEsThreadPoolExecutor.java:153)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
    at java.lang.Thread.run(Thread.java:722)
Caused by: java.lang.IllegalArgumentException: Invalid format: [ISO8601]: Illegal pattern component: I
    at org.elasticsearch.common.joda.Joda.forPattern(Joda.java:160)
    at org.elasticsearch.common.joda.Joda.forPattern(Joda.java:37)
    at org.elasticsearch.index.mapper.core.TypeParsers.parseDateTimeFormatter(TypeParsers.java:295)
    at org.elasticsearch.index.mapper.core.DateFieldMapper$TypeParser.parse(DateFieldMapper.java:155)
    at org.elasticsearch.index.mapper.object.ObjectMapper$TypeParser.parseProperties(ObjectMapper.java:289)
    at org.elasticsearch.index.mapper.object.ObjectMapper$TypeParser.parseObjectOrDocumentTypeProperties(ObjectMapper.java:217)
    at org.elasticsearch.index.mapper.object.RootObjectMapper$TypeParser.parse(RootObjectMapper.java:136)
    at org.elasticsearch.index.mapper.DocumentMapperParser.parse(DocumentMapperParser.java:209)
    at org.elasticsearch.index.mapper.DocumentMapperParser.parseCompressed(DocumentMapperParser.java:190)
    at org.elasticsearch.index.mapper.MapperService.parse(MapperService.java:440)
    at org.elasticsearch.index.mapper.MapperService.merge(MapperService.java:313)
    at org.elasticsearch.cluster.metadata.MetaDataCreateIndexService.execute(MetaDataCreateIndexService.java:383)
    ... 5 more
Caused by: java.lang.IllegalArgumentException: Illegal pattern component: I
    at org.elasticsearch.common.joda.time.format.DateTimeFormat.parsePatternTo(DateTimeFormat.java:570)
    at org.elasticsearch.common.joda.time.format.DateTimeFormat.createFormatterForPattern(DateTimeFormat.java:693)
    at org.elasticsearch.common.joda.time.format.DateTimeFormat.forPattern(DateTimeFormat.java:181)
    at org.elasticsearch.common.joda.Joda.forPattern(Joda.java:158)
    ... 16 more

我正在使用 logstash (1.4.2) 将我的日志发送到 ElasticSearch。我的 grok 过滤器非常简单，如下所示。我将时间戳保存为字符串 "logts".

filter {
    grok {
        match => [ "message", "%{DATA:logts}%{SPACE}\[%{LOGLEVEL:level}%{SPACE}]%{SPACE}\[%{DATA:thread}]%{SPACE}\[%{DATA:classname}]%{SPACE}%{GREEDYDATA:details}" ]
    }    
}

我的日志文件中的示例行是：

2015-01-09 14:53:07,035-0800 [ERROR] [pool-1-thread-2] [LogGenerator] invocation count=101,time=95840107816543,metric=6688916707300087716

我运行带有“-vv”标志的 logstash，我在输出中没有看到任何“[ISO8601]”。

有谁知道在哪里引入了无效格式？

要点可用 here。

Answer 1

我删除了我的 Elasticsearch 安装（这是一个测试环境）并重新安装，它又开始工作了。

我怀疑如果我删除了我的索引，它也会解决问题。

错误格式无效：[ISO8601] 在 ElasticSearch 中索引日志时

Error Invalid format: [ISO8601] when indexing logs in ElasticSearch

elasticsearch

logstash