Elastalert parsing exception

[ngms17]

Elastalert throws this exception:

Oct 15 11:43:12 evesuri elastalert[304844]: WARNING:elasticsearch:POST https://x.x.x.x:9200/elastalert_status/_doc [status:400 request:0.008s]
Oct 15 11:43:12 evesuri elastalert[304844]: ERROR:elastalert:Error writing alert info to Elasticsearch: RequestError(400, 'document_parsing_exception', "[1:352] failed to parse field [match_time] of type [date] in document with id 'vd3Gj5IB2Kl_iGwxUnYb'. Preview of field's value: '2024-10-15 11:43 WEST'")

Is there any way to solve this?

Thanks for your help

[jertel]

Perhaps your data's timestamp_field (by default it's @timestamp) contains a string, and not an actual date/time object?

[ngms17]

Hmmm i think so. Sometime ago i created a TimeEnhancement because the alerts where not showing on my timezone. Is there a way (by default) for the alerts to be shown in my local time? UTC +1

[jertel]

If you're talking about showing the time in an alert text subject or body, then perhaps your TimeEnhancement should be copying the @timestamp field into a new field named "local_timestamp", so it doesn't touch the original timestamp. Then reference that new field in your formatted alert message.

[ngms17]

If i have no TimeEnhancement, this error does not appear and the alerts come with timestamp UTC (which is not my local time). If i configure the TimeEnhancement, this error appears and the timestamp in the email alerts is shown in my correct timezone 2024-10-15 11:43 WEST.

So, the TimeEnhancement must be the reason why this parsing exception occurs

[jertel]

I agree. Try my advice I posted above and I bet that will allow you to continue using your enhancement without causing the error.