Hi Al, On Wednesday, 8 February 2017 15:46:07 UTC+1, Al Reynolds wrote: > > WO_Timestamp > 2017-02-08 09:42:30,056 > > Those messages are with the date parsing disabled. I'm attempting to > replace "timestamp" with the "WO_Timestamp" field. >
The string in WO_Timestamp doesn't match the pattern "YYYY-MM-dd HH:mm:ss,sss" used in parse_date(). See http://www.joda.org/joda-time/apidocs/org/joda/time/format/DateTimeFormat.html for details. Hint: 's' and 'S' are not the same thing. Side note: The full_message field is empty on my filebeat inputs--is that > expected behavior? > Yes, that's expected. What would you expect to find in the (optional) full_message field? Cheers, Jochen -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/8e3d890e-8c2a-473e-b9c4-8d17f65ac47e%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
