__dateparsefailure trying match date


#1

Hi,

I'm trying to match timestamp from log file and i have an _dateparsefailure :frowning:

This is my grok pattern (it match) :
grok {
match => { "message" => ["\[(?<logtimestamp>%{MONTHDAY}-%{MONTH}-%{YEAR}\s+%{TIME})\] %{DATA:level}:\s?(?:\[%{DATA:pool}\])?\s?%{GREEDYDATA:infos}"] }
}

my date filter:
date {
locale => "fr"
timezone => "Europe/Paris"
match => [ "logtimestamp", "dd-MMM-yyyy HH:mm:ss" ]
}
(I already try without locale and timezone set)

an example of input:
[15-Jan-2017 16:53:35] WARNING: Too many warnings call warning owner.

And the result of :
{
"logtimestamp" => "15-Jan-2017 16:53:35",
"@timestamp" => 2017-09-15T20:20:29.133Z,
"level" => "WARNING",
"@version" => "1",
"infos" => "Too many warnings call warning owner.",
"tags" => [
[0] "_dateparsefailure"
]
}

As you see, my match fail... Do I miss something ?
Thanks for your future answers :smile:
Samuel.


(Magnus Bäck) #2

Look in your Logstash log. The date filter will tell you more about why it's failing to parse.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.