Skip to content

Conversation

okliv
Copy link

@okliv okliv commented Oct 2, 2025

Bug Report Summary
When using tracking_field with logstash-input-elasticsearch and the default scroll API, Logstash sends the literal string :last_value instead of the resolved timestamp. This causes Elasticsearch to fail parsing with:

    failed to parse date field [:last_value] with format [strict_date_optional_time_nanos]
    caused_by: Text ':last_value' could not be parsed at index 0

Workaround
Use search_api => "search_after" instead of the default scroll.

System has to notify about it somehow. I've spent a lot of time while i figured it out.

raise error when search_api is not "search_after"
Copy link

❌ Author of the following commits did not sign a Contributor Agreement:
25b51c3

Please, read and sign the above mentioned agreement if you want to contribute to this project

@okliv okliv changed the title raise error when search_api is not "search_after" raise error when search_api is not "search_after" when using tracking_field Oct 2, 2025
@okliv okliv changed the title raise error when search_api is not "search_after" when using tracking_field raise error when using tracking_field and search_api is not "search_after" Oct 2, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant