Home » Categories » Products » Nagios Log Server » Troubleshooting » Common Problems

Logs Not Appearing with Failed to Parse Date Error

Problem Description

Logs are not coming in and you see an error like this in the Logstash log:

:response=>{"create"=>{"_index"=>"logstash-2019.12.13", "_type"=>"syslog", "_id"=>"AW8Ab04im8e-JsUH61
c5", "status"=>400, "error"=>"MapperParsingException[failed to parse [timestamp8601]]; nested: MapperParsingException[
failed to parse date field [2019-12-13 18:04:52.81], tried both date format [dateOptionalTime], and timestamp number w
ith locale []]; nested: IllegalArgumentException[Invalid format: \"2019-12-13 18:04:52.81\" is malformed at \" 18:04:5
2.81\"]; "}}

You also have multiple identical input types (ex. syslog) in your input configuration, something like the following:

syslog {
  port => xxx
  type => 'syslog'
}

syslog {
    port => xxxx
    type => 'syslog'
    tags => 'Linux-Max'
}

Solution 

Logs coming in on the same input need to use the same formatting so that parsing works properly. The format that the input expects is somewhat flexible initially but once the first message comes in, the format is set(until the next day's index is created). For example, the syslog input expects all input to follow rfc3164 which can send a message like:

<0>1990 Oct 22 10:52:01 TZ-6 scapegoat.dmz.example.org 10.1.2.3 sched[0]: That's All Folks!

If a message with a different date format then comes in([2019-12-13 18:04:52.81]) you'll see a message logged like the one you see.

The fix is to make sure that all devices use the same date format or configure another input for these devices. For example:

syslog {
    port => xxxx
    type => 'alternative-syslog'
    tags => 'alternative Linux-Max'
}

See the Advanced Configuration section of the Sending ESXi Logs to Nagios Log Server document for more information on how to set the type field for specific hosts(in cases where different logs formats need to come in on the same input.

0 (0)
Article Rating (No Votes)
Rate this article
  • Icon PDFExport to PDF
  • Icon MS-WordExport to MS Word
Attachments Attachments
There are no attachments for this article.
Related Articles RSS Feed
Nagios Log Server - License Key Not Accepted
Viewed 2020 times since Wed, Apr 12, 2017
Web Browser Reports 330 Error Content Encoding
Viewed 1995 times since Tue, Mar 7, 2017
Forwarding Logs from Nagios Log Server to Another Destination
Viewed 795 times since Wed, Sep 16, 2020
Nagios Log Server - Logs Not Searchable or Not Coming In
Viewed 6408 times since Tue, Jan 27, 2015
Active Directory / LDAP - Troubleshooting Authentication Integration
Viewed 7080 times since Mon, Jun 26, 2017
Nagios Log Server - Newline Character Added When Adding A Filter To A Search
Viewed 2014 times since Wed, Apr 27, 2016
Nagios Log Server - Troubleshooting Backups
Viewed 2002 times since Fri, Apr 15, 2016
Nagios Log Server - License Activation Issues
Viewed 2042 times since Wed, Dec 13, 2017
Nagios Log Server - Administration Page Fails To Display
Viewed 2968 times since Thu, Jan 21, 2016
Nagios Log Server - Understanding and Troubleshooting Red Cluster Health
Viewed 3507 times since Mon, Apr 6, 2015