gistfile1.txt

[2013-10-01 01:50:18,734][DEBUG][action.bulk              ] [Logstash] [logstash-2013.10.01][0] failed to execute bulk item (index) index {[logstash-2013.10.01][postfix][7og6VD7JSWOG9MQc1KSo1w], source[{"@source":"file://mail4//var/log/mail.log","@tags":["mail4_mail.log","easymail","mail4"],"@fields":{"date":["Oct  1 01:55:46"],"host":["mail4"],"service":["dovecot"],"program":["dovecot"],"message":["imap(user@example.com): Debug: Quota root: name=User quota backend=maildir args="]},"@timestamp":"2013-10-01T05:55:47.142Z","@source_host":"mail4","@source_path":"//var/log/mail.log","@message":"imap(user@example.com): Debug: Quota root: name=User quota backend=maildir args=","@type":"postfix"}]}
org.elasticsearch.index.mapper.MapperParsingException: failed to parse [@fields.date]
	at org.elasticsearch.index.mapper.core.AbstractFieldMapper.parse(AbstractFieldMapper.java:396)
	at org.elasticsearch.index.mapper.object.ObjectMapper.serializeValue(ObjectMapper.java:614)
	at org.elasticsearch.index.mapper.object.ObjectMapper.serializeArray(ObjectMapper.java:602)
	at org.elasticsearch.index.mapper.object.ObjectMapper.parse(ObjectMapper.java:459)
	at org.elasticsearch.index.mapper.object.ObjectMapper.serializeObject(ObjectMapper.java:515)
	at org.elasticsearch.index.mapper.object.ObjectMapper.parse(ObjectMapper.java:457)
	at org.elasticsearch.index.mapper.DocumentMapper.parse(DocumentMapper.java:508)
	at org.elasticsearch.index.mapper.DocumentMapper.parse(DocumentMapper.java:452)
	at org.elasticsearch.index.shard.service.InternalIndexShard.prepareCreate(InternalIndexShard.java:320)
	at org.elasticsearch.action.bulk.TransportShardBulkAction.shardIndexOperation(TransportShardBulkAction.java:401)
	at org.elasticsearch.action.bulk.TransportShardBulkAction.shardOperationOnPrimary(TransportShardBulkAction.java:155)
	at org.elasticsearch.action.support.replication.TransportShardReplicationOperationAction$AsyncShardOperationAction.performOnPrimary(TransportShardReplicationOperationAction.java:533)
	at org.elasticsearch.action.support.replication.TransportShardReplicationOperationAction$AsyncShardOperationAction$1.run(TransportShardReplicationOperationAction.java:418)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603)
	at java.lang.Thread.run(Thread.java:636)
Caused by: org.elasticsearch.index.mapper.MapperParsingException: failed to parse date field [Oct  1 01:55:46], tried both date format [MMM dd HH:mm:ss], and timestamp number with locale [null]
	at org.elasticsearch.index.mapper.core.DateFieldMapper.parseStringValue(DateFieldMapper.java:465)
	at org.elasticsearch.index.mapper.core.DateFieldMapper.innerParseCreateField(DateFieldMapper.java:413)
	at org.elasticsearch.index.mapper.core.NumberFieldMapper.parseCreateField(NumberFieldMapper.java:188)
	at org.elasticsearch.index.mapper.core.AbstractFieldMapper.parse(AbstractFieldMapper.java:385)
	... 15 more
Caused by: java.lang.IllegalArgumentException: Invalid format: "Oct  1 01:55:46" is malformed at " 1 01:55:46"
	at org.elasticsearch.common.joda.time.format.DateTimeFormatter.parseMillis(DateTimeFormatter.java:754)
	at org.elasticsearch.index.mapper.core.DateFieldMapper.parseStringValue(DateFieldMapper.java:459)
	... 18 more