# \_dateparsefailure again

**URL:** <https://discuss.elastic.co/t/-dateparsefailure-again/87475>\
**Category:** Logstash\
**Created:** [May 29, 2017, 3:38pm UTC](https://discuss.elastic.co/t/-dateparsefailure-again/87475 "2017-05-29T15:38:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![santihago](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@santihago](https://discuss.elastic.co/u/santihago)\
**Post date:** [May 29, 2017, 3:38pm UTC](https://discuss.elastic.co/t/-dateparsefailure-again/87475/1 "2017-05-29T15:38:04Z")

</div>

Hi everyone!

I have this configuration:

filter{  
grok{  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:severity} [%{DATA:class}] %{GREEDYDATA:message}" }  
}  
date{  
match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss,SSS"]  
}  
}

And my app log lines are like this:

2017-05-29 09:17:13.0214 INFO [HQ.TIMServices.ProgramService] Message bla bla bla...

The grok filter is working properly but the date filter is not working, the error is the famous: \_dateparsefailure

What am I missing?

Thanks in advance!

Santiago

---

<div class="post-metadata">

**Author:** ![Charles.w](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charles.w/32/15486_2.png) [@Charles.w](https://discuss.elastic.co/u/Charles.w)\
**Post date:** [May 29, 2017, 5:08pm UTC](https://discuss.elastic.co/t/-dateparsefailure-again/87475/2 "2017-05-29T17:08:21Z")

</div>

Hi,

There's a typo in the date format, I do believe you should use yyy-MM-dd HH:mm:ss.SSS instead of yyy-MM-dd HH:mm:ss,SSS 😉

-- edit --

Spoke too soon 😃

You should use yyy-MM-dd HH:mm:ss.SSSS . Furthermore, as your subsecond part is a little more precise than what is supported by logstash, it will be truncated to milliseconds.

Here's my logstash pipeline :

```
input { stdin {} }

filter {
	grok {
		match => { "message" => "%{TIMESTAMP_ISO8601:my_timestamp}" }
	}
	date {
		match => ["my_timestamp", "yyyy-MM-dd HH:mm:ss.SSSS"]
		target => "my_timestamp_parsed"
	}
}

output {stdout { codec => rubydebug } }

```

And here's a sample output :

```
current/bin/logstash -f sample.conf 
Sending Logstash's logs to .../current/logs which is now configured via log4j2.properties
[2017-05-29T19:40:43,153][INFO][logstash.pipeline] Starting pipeline {"id"=>"main", "pipeline.workers"=>16, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>2000}
[2017-05-29T19:40:43,175][INFO][logstash.pipeline] Pipeline main started
The stdin plugin is now waiting for input:
[2017-05-29T19:40:43,212][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
2017-05-29 09:17:13.0214
{
             "@timestamp" => 2017-05-29T17:40:55.424Z,
           "my_timestamp" => "2017-05-29 09:17:13.0214",
               "@version" => "1",
                   "host" => "localhost.localdomain",
    "my_timestamp_parsed" => 2017-05-29T07:17:13.021Z,
                "message" => "2017-05-29 09:17:13.0214"
}

```

Best regards,

Charles.w

---

<div class="post-metadata">

**Author:** ![santihago](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@santihago](https://discuss.elastic.co/u/santihago)\
**Post date:** [May 30, 2017, 3:00pm UTC](https://discuss.elastic.co/t/-dateparsefailure-again/87475/3 "2017-05-30T15:00:31Z")

</div>

Hi! thanks for your reply! I had tried that before and it didn't work. I've been able to solve it by appliying this filter:

match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss'.'SSSS"]

I still don't know what is wrong but now, at least, it's working.

Thanks Charles!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 27, 2017, 3:00pm UTC](https://discuss.elastic.co/t/-dateparsefailure-again/87475/4 "2017-06-27T15:00:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.