gergues / sharepoint-elk Goto Github PK

After indexing about 7GB of log data I am getting many of these in my logs complaining about a malformed date. I'll also mention that the indices seem to outweigh the amount of logs by a fair amount.

21:48:27.974 [[main]>worker1] WARN logstash.outputs.elasticsearch - Failed action. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"spuls2-spuls.2017.03.17", :_type=>"spuls", :_routing=>nil}, 2017-03-17T01:48:26.117Z usatramelk003 03/15/2017 18:04:06.84* w3wp.exe (0x5EF4) 0x3234 SharePoint Foundation General
ai1wu Medium ...Ptr moduleData, Int32 flags) at System.Web.Hosting.PipelineRuntime.ProcessRequestNotification(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)], :response=>{"index"=>{"_index"=>"spuls2-spuls.2017.03.17", "_type"=>"spuls", "_id"=>"AVrZ86SQk0_IuXcb_tSW", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [sptimestamp]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: "03/15/2017 18:04:06.84*" is malformed at "/15/2017 18:04:06.84*""}}}}}

Everything is working fine. Many thanks.

Could you also please provide the Kibana Visualization config files as described in your blog?