Grafana 9.5.3
Debian 12
I am attempting to plot some raw data from opensearch.
I tried using the example PPL query, using my index name instead:
source=obd2_1 | eval dateValue=timestamp(timestamp)
When I run the query inspector, it gives me this error:
Object
request:Object
url:"api/datasources/proxy/uid/V6-E-8-4z/_opendistro/_ppl"
method:"POST"
data:"{\"query\":\"source=obd2_1 | where `timestamp` >= timestamp('2023-06-10 21:15:58') and `timestamp` <= timestamp('2023-06-12 21:15:58') | eval dateValue=timestamp(timestamp)\"}"
hideFromInspector:false
response:Object
error:Object
reason:"Invalid Query"
details:"Construct ExprTimestampValue from \"2023-06-12 11:21:54.808\" failed, unsupported date format."
type:"IllegalArgumentException"
status:400
The logs were ingested through graylog, and the timestamp field in there is correct and recognized as a timestamp by opensearch.
I’m new to PPL, what is the issue here? Can someone help me?