{"action":"created","issue":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2030","repository_url":"https://api.github.com/repos/Graylog2/graylog2-server","labels_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2030/labels{/name}","comments_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2030/comments","events_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2030/events","html_url":"https://github.com/Graylog2/graylog2-server/issues/2030","id":146002388,"number":2030,"title":"JSON extractor fails to parse timestamp in ISO8601 format","user":{"login":"tiagomlalves-talkdesk","id":17250288,"avatar_url":"https://avatars.githubusercontent.com/u/17250288?v=3","gravatar_id":"","url":"https://api.github.com/users/tiagomlalves-talkdesk","html_url":"https://github.com/tiagomlalves-talkdesk","followers_url":"https://api.github.com/users/tiagomlalves-talkdesk/followers","following_url":"https://api.github.com/users/tiagomlalves-talkdesk/following{/other_user}","gists_url":"https://api.github.com/users/tiagomlalves-talkdesk/gists{/gist_id}","starred_url":"https://api.github.com/users/tiagomlalves-talkdesk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tiagomlalves-talkdesk/subscriptions","organizations_url":"https://api.github.com/users/tiagomlalves-talkdesk/orgs","repos_url":"https://api.github.com/users/tiagomlalves-talkdesk/repos","events_url":"https://api.github.com/users/tiagomlalves-talkdesk/events{/privacy}","received_events_url":"https://api.github.com/users/tiagomlalves-talkdesk/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Graylog2/graylog2-server/labels/question","name":"question","color":"c7def8"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-04-05T14:12:13Z","updated_at":"2016-04-11T09:47:07Z","closed_at":"2016-04-11T09:47:07Z","body":"### Problem description\r\n\r\nJSON extractor fails to parse timestamp in ISO8601 UTC format. Input is '2016-04-05T13:13:09.633Z' and exception is:\r\n\r\nmessage [MapperParsingException[failed to parse [timestamp]]; nested: MapperParsingException[failed to parse date field [2016-04-05T13:13:09.633Z], tried both date format [yyyy-MM-dd HH:mm:ss.SSS], and timestamp number with locale []]; nested: IllegalArgumentException[Invalid format: \"2016-04-05T13:13:09.633Z\" is malformed at \"T13:13:09.633Z\"]; ]\r\n\r\nMy expectation would be that at least JSON parser would fall back to interpret this field as string and not fail altogether. The better solution would be parsing this field correctly.\r\n\r\n### Steps to reproduce the problem\r\n\r\n1. Create a JSON extractor\r\n2. Load a sample log:\r\n\r\n`{\"application\":{\"name\":\"dummy-app\",\"component\":\"dummy-component\"},\"timestamp\":\"2016-04-05T14:09:02.670Z\",\"measurement\":{\"source\":\"method\",\"metric\":\"throughput\",\"value\":0.537671}}`\r\n\r\n3. Click \"Try!\" Here the preview works perfectly showing that the son was extracted correctly\r\n4. Click \"Create Extractor\"\r\n5. Check graylog2-server logs and see that messages as from the sample are creating JSON parsing exceptions. \r\n\r\n### Environment\r\n\r\nDocker image graylog2/allinone retrieved on 2016-04-05.\r\ngraylog-web-interface v1.3.4 (0d67a80) (Oracle Corporation 1.8.0_66 / Linux 4.1.19-boot2docker) on 777153dc2b18"},"comment":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/comments/208260870","html_url":"https://github.com/Graylog2/graylog2-server/issues/2030#issuecomment-208260870","issue_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2030","id":208260870,"user":{"login":"kroepke","id":52014,"avatar_url":"https://avatars.githubusercontent.com/u/52014?v=3","gravatar_id":"","url":"https://api.github.com/users/kroepke","html_url":"https://github.com/kroepke","followers_url":"https://api.github.com/users/kroepke/followers","following_url":"https://api.github.com/users/kroepke/following{/other_user}","gists_url":"https://api.github.com/users/kroepke/gists{/gist_id}","starred_url":"https://api.github.com/users/kroepke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kroepke/subscriptions","organizations_url":"https://api.github.com/users/kroepke/orgs","repos_url":"https://api.github.com/users/kroepke/repos","events_url":"https://api.github.com/users/kroepke/events{/privacy}","received_events_url":"https://api.github.com/users/kroepke/received_events","type":"User","site_admin":false},"created_at":"2016-04-11T09:47:07Z","updated_at":"2016-04-11T09:47:07Z","body":"You need to convert the timestamp field to a proper timestamp using the \"flex date\" converter, the JSON extractor does not interpret the field value at all in this case.\r\nThe elasticsearch mapping expects a certain format, which unfortunately is not ISO 8601.\r\n\r\nI'll close the issue for now, as this is not a bug per se.\r\n\r\nThanks,\r\nKay"}}