{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/logstash/issues/4989","repository_url":"https://api.github.com/repos/elastic/logstash","labels_url":"https://api.github.com/repos/elastic/logstash/issues/4989/labels{/name}","comments_url":"https://api.github.com/repos/elastic/logstash/issues/4989/comments","events_url":"https://api.github.com/repos/elastic/logstash/issues/4989/events","html_url":"https://github.com/elastic/logstash/issues/4989","id":145607228,"number":4989,"title":"Invalid date makes logstash crash","user":{"login":"martinhynar","id":1698238,"avatar_url":"https://avatars.githubusercontent.com/u/1698238?v=3","gravatar_id":"","url":"https://api.github.com/users/martinhynar","html_url":"https://github.com/martinhynar","followers_url":"https://api.github.com/users/martinhynar/followers","following_url":"https://api.github.com/users/martinhynar/following{/other_user}","gists_url":"https://api.github.com/users/martinhynar/gists{/gist_id}","starred_url":"https://api.github.com/users/martinhynar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martinhynar/subscriptions","organizations_url":"https://api.github.com/users/martinhynar/orgs","repos_url":"https://api.github.com/users/martinhynar/repos","events_url":"https://api.github.com/users/martinhynar/events{/privacy}","received_events_url":"https://api.github.com/users/martinhynar/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/elastic/logstash/labels/needs%20details","name":"needs details","color":"cc317c"},{"url":"https://api.github.com/repos/elastic/logstash/labels/unconfirmed","name":"unconfirmed","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2016-04-04T07:29:05Z","updated_at":"2016-04-04T09:44:23Z","closed_at":null,"body":"Hi,\r\n\r\nI am running logstash 1.5.3 with output to elasticsearch and logstash crashes on invalid date format - `{\"@timestamp\":\"2016-04-01T024752.995-0700\"}` - missing colons in time.\r\n\r\nI am getting this error:\r\n```\r\nNoMethodError: undefined method `tv_sec' for \"2016-04-01T024752.995-0700\":String\r\n       evaluate at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.3-java/lib/logstash/string_interpolation.rb:134\r\n       evaluate at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.3-java/lib/logstash/string_interpolation.rb:79\r\n        collect at org/jruby/RubyArray.java:2407\r\n       evaluate at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.3-java/lib/logstash/string_interpolation.rb:79\r\n       evaluate at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.3-java/lib/logstash/string_interpolation.rb:26\r\n        sprintf at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.3-java/lib/logstash/event.rb:222\r\n        receive at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.5-java/lib/logstash/outputs/elasticsearch.rb:504\r\n         handle at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.3-java/lib/logstash/outputs/base.rb:88\r\n    output_func at (eval):1755\r\n   outputworker at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.3-java/lib/logstash/pipeline.rb:244\r\n  start_outputs at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.3-java/lib/logstash/pipeline.rb:166\r\n```\r\n\r\nI understood that there should be improved handling of invalid inputs to avoid complete crash based on #1240 and #1250 but seems that some cases were missed."},"comment":{"url":"https://api.github.com/repos/elastic/logstash/issues/comments/205215877","html_url":"https://github.com/elastic/logstash/issues/4989#issuecomment-205215877","issue_url":"https://api.github.com/repos/elastic/logstash/issues/4989","id":205215877,"user":{"login":"jsvd","id":31809,"avatar_url":"https://avatars.githubusercontent.com/u/31809?v=3","gravatar_id":"","url":"https://api.github.com/users/jsvd","html_url":"https://github.com/jsvd","followers_url":"https://api.github.com/users/jsvd/followers","following_url":"https://api.github.com/users/jsvd/following{/other_user}","gists_url":"https://api.github.com/users/jsvd/gists{/gist_id}","starred_url":"https://api.github.com/users/jsvd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsvd/subscriptions","organizations_url":"https://api.github.com/users/jsvd/orgs","repos_url":"https://api.github.com/users/jsvd/repos","events_url":"https://api.github.com/users/jsvd/events{/privacy}","received_events_url":"https://api.github.com/users/jsvd/received_events","type":"User","site_admin":false},"created_at":"2016-04-04T09:44:23Z","updated_at":"2016-04-04T09:44:23Z","body":"I'm not sure how the event got created with such an internal structure.\r\nin the place where it crashes, logstash is doing `event.sprintf(\"logs-%{+YYYY-MM-dd}\")`\r\n\r\nwhich works for a normally created event:\r\n\r\n```\r\n1.9 :007 > LogStash::Event.new.sprintf(\"logs-%{+YYYY-MM-dd}\")\r\n => \"logs-2016-04-04\" \r\n```\r\n\r\ngiving it the malformed timestamp does not work well but does not crash, because the parsing of @timestamp fails and the current timestamp is used instead:\r\n\r\n```\r\n1.9 :010 > LogStash::Event.new(\"@timestamp\" => \"2016-04-01T024752.995-0700\").sprintf(\"logs-%{+YYYY-MM-dd}\")\r\n => \"logs-2016-04-04\" \r\n1.9 :011 > LogStash::Event.new(\"@timestamp\" => \"2016-04-01T024752.995-0700\")[\"tags\"]\r\n => [\"_timestampparsefailure\"] \r\n1.9 :012 > LogStash::Event.new(\"@timestamp\" => \"2016-04-01T024752.995-0700\")[\"@timestamp\"]\r\n => \"2016-04-04T09:43:25.793Z\" \r\n```\r\n\r\n@driskell any idea on how this logstash event is being created so that the @timestamp is \"corrupt\"? it seems to be skipping the usual validation"}}