Question

当我尝试将我的日志索引到ElasticSearch（1.3.4）时，我看到了一个异常。我看到的异常的根本原因如下（编辑我的初始帖子以提供完整的堆栈跟踪）

[2015-01-09 15:53:00,953][DEBUG][action.admin.indices.create] [perfgen04 1] [logaggr-2015.01.09] failed to create
org.elasticsearch.index.mapper.MapperParsingException: mapping [test]
    at org.elasticsearch.cluster.metadata.MetaDataCreateIndexService$2.execute(MetaDataCreateIndexService.java:386)
    at org.elasticsearch.cluster.service.InternalClusterService$UpdateTask.run(InternalClusterService.java:328)
    at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.run(PrioritizedEsThreadPoolExecutor.java:153)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
    at java.lang.Thread.run(Thread.java:722)
Caused by: java.lang.IllegalArgumentException: Invalid format: [ISO8601]: Illegal pattern component: I
    at org.elasticsearch.common.joda.Joda.forPattern(Joda.java:160)
    at org.elasticsearch.common.joda.Joda.forPattern(Joda.java:37)
    at org.elasticsearch.index.mapper.core.TypeParsers.parseDateTimeFormatter(TypeParsers.java:295)
    at org.elasticsearch.index.mapper.core.DateFieldMapper$TypeParser.parse(DateFieldMapper.java:155)
    at org.elasticsearch.index.mapper.object.ObjectMapper$TypeParser.parseProperties(ObjectMapper.java:289)
    at org.elasticsearch.index.mapper.object.ObjectMapper$TypeParser.parseObjectOrDocumentTypeProperties(ObjectMapper.java:217)
    at org.elasticsearch.index.mapper.object.RootObjectMapper$TypeParser.parse(RootObjectMapper.java:136)
    at org.elasticsearch.index.mapper.DocumentMapperParser.parse(DocumentMapperParser.java:209)
    at org.elasticsearch.index.mapper.DocumentMapperParser.parseCompressed(DocumentMapperParser.java:190)
    at org.elasticsearch.index.mapper.MapperService.parse(MapperService.java:440)
    at org.elasticsearch.index.mapper.MapperService.merge(MapperService.java:313)
    at org.elasticsearch.cluster.metadata.MetaDataCreateIndexService$2.execute(MetaDataCreateIndexService.java:383)
    ... 5 more
Caused by: java.lang.IllegalArgumentException: Illegal pattern component: I
    at org.elasticsearch.common.joda.time.format.DateTimeFormat.parsePatternTo(DateTimeFormat.java:570)
    at org.elasticsearch.common.joda.time.format.DateTimeFormat.createFormatterForPattern(DateTimeFormat.java:693)
    at org.elasticsearch.common.joda.time.format.DateTimeFormat.forPattern(DateTimeFormat.java:181)
    at org.elasticsearch.common.joda.Joda.forPattern(Joda.java:158)
    ... 16 more

我正在使用logstash（1.4.2）将我的日志发送到ElasticSearch。我的grok过滤器非常简单，如下所示。我将时间戳保持为字符串“logts”。

filter {
    grok {
        match => [ "message", "%{DATA:logts}%{SPACE}\[%{LOGLEVEL:level}%{SPACE}]%{SPACE}\[%{DATA:thread}]%{SPACE}\[%{DATA:classname}]%{SPACE}%{GREEDYDATA:details}" ]
    }    
}

我的日志文件中的示例行是：

2015-01-09 14:53:07,035-0800 [ERROR] [pool-1-thread-2] [LogGenerator] invocation count=101,time=95840107816543,metric=6688916707300087716

我使用'-vv'标志运行logstash，输出中没有看到任何“[ISO8601]”。

有谁知道引入无效格式的位置？

Gist可用here。

Answer 1

我删除了我的Elasticsearch安装（这是一个测试环境）并重新安装，这又开始了。

我怀疑如果我删除了我的索引，它也会解决问题。

错误格式无效格式：[ISO8601]索引ElasticSearch中的日志时

1 个答案: