logstash-plugins / logstash-filter-date

Apache License 2.0
7 stars 43 forks source link

Trap and report exception with invalid interpolated timezone better #66

Open prehor opened 8 years ago

prehor commented 8 years ago

When I use interpolated variable for timezone I got exception:

{
    :timestamp=>"2016-06-12T21:11:52.153000+0000", 
    :message=>"Failed parsing date from field", 
    :field=>"[@metadata][syslog][timestamp]", 
    :value=>"Jun 12 03:13:22", 
    :exception=>"wrong number of arguments (2 for 1)", 
    :config_parsers=>"MMM dd HH:mm:ss,MMM  d HH:mm:ss", 
    :config_locale=>"default=en", 
    :level=>:warn
}

Filter configuration:

date {
    match => [
        "[@metadata][syslog][timestamp]",
        "MMM dd HH:mm:ss",
        "MMM  d HH:mm:ss"
    ]
    locale => "en"
    timezone => "%{[@metadata][syslog][timezone]}"
    tag_on_failure => "invalid_timestamp"
}

[@metadata][syslog][timezone] contains "Europe/Prague"

When I use timezone => "Europe/Prague" timestamp is parsed without error.

I'm using Logstash 2.3.2 in Docker.

prehor commented 8 years ago

I have investigated the problem and found a mistake in may configuration - [@metadata][syslog][timezone] does not contains valid zone name for some hosts and it was the root of the problem.

Would it be possible to add information about used timezone to the exception?

guyboertje commented 7 years ago

If a interpolated string that is not a supported Timezone string we get an exception and a parse failure but it is not reported very well. e.g. Europe/Berlim.