__dateparsefailure trying match date

Hi,

I'm trying to match timestamp from log file and i have an _dateparsefailure :frowning:

This is my grok pattern (it match) :
grok {
match => { "message" => ["\[(?<logtimestamp>%{MONTHDAY}-%{MONTH}-%{YEAR}\s+%{TIME})\] %{DATA:level}:\s?(?:\[%{DATA:pool}\])?\s?%{GREEDYDATA:infos}"] }
}

my date filter:
date {
locale => "fr"
timezone => "Europe/Paris"
match => [ "logtimestamp", "dd-MMM-yyyy HH:mm:ss" ]
}
(I already try without locale and timezone set)

an example of input:
[15-Jan-2017 16:53:35] WARNING: Too many warnings call warning owner.

And the result of :
{
"logtimestamp" => "15-Jan-2017 16:53:35",
"@timestamp" => 2017-09-15T20:20:29.133Z,
"level" => "WARNING",
"@version" => "1",
"infos" => "Too many warnings call warning owner.",
"tags" => [
[0] "_dateparsefailure"
]
}

As you see, my match fail... Do I miss something ?
Thanks for your future answers :smile:
Samuel.

Look in your Logstash log. The date filter will tell you more about why it's failing to parse.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.