Custom time format issue

[ochanism]

I am using a time format [ yyyy-MM-dd HH:mm:ss.SSS ] for elasticsearch data.
Thus, I tried to configure time format with custom type like this.

timestamp_field: timestamp
timestamp_type: custom
timestamp_format: "%Y-%m-%d %H:%M:%S.%f"

But, %f is for microsecond, not millisecond.
So I got this error.

[{u'reason': u'failed to parse date field [2016-07-04 02:27:56.274273] with format [yyyy-MM-dd HH:mm:ss.SSS]', u'type': u'parse_exception'}]

Is there any way to configure custom time format for millisecond?

[Qmando]

Unfortunately, Python doesn't support millisecond-only accurate with strftime.

I have not really tested this, but as a temporary fix, you can try replacing this line (

elastalert/elastalert/util.py

Line 142 in d5617c3

return ts

) with return ts[:-3]
That should make it cut off the last 3 digits of the timestamp.

Going the other way, python will accept .274 or .274000 milliseconds as equivalent, so that should be ok.