# \_dateparsefailure error despite appearing correctly

**URL:** <https://discuss.elastic.co/t/-dateparsefailure-error-despite-appearing-correctly/94260>\
**Category:** Logstash\
**Created:** [July 24, 2017, 1:32am UTC](https://discuss.elastic.co/t/-dateparsefailure-error-despite-appearing-correctly/94260 "2017-07-24T01:32:03Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![JohnWayne](https://avatars.discourse-cdn.com/v4/letter/j/a698b9/32.png) [@JohnWayne](https://discuss.elastic.co/u/JohnWayne)\
**Post date:** [July 24, 2017, 1:32am UTC](https://discuss.elastic.co/t/-dateparsefailure-error-despite-appearing-correctly/94260/1 "2017-07-24T01:32:03Z")

</div>

Hi All,

I've been testing out the very basics of ELK and I was able to get an index going by reading a simple CSV. As a test, I tried to do ANOTHER index with the same timestamp format, but different columns and it gave me a \_dateparsefailure. I deleted the whole logstash, tried using the same CSV as the original and it still complained the same.

Any pointers would be appreciated. Below is my sample logstash.conf and CSV:

> input {  
> file {  
> path =\> "PiT.csv"  
> start\_position =\> "beginning"  
> }  
> }  
> filter {  
> csv {  
> separator =\> ","  
> columns =\> ["DATE","QUEUE","MAX","JLU","PEND","RUN","SUSP"]  
> }  
> date {  
> match =\> ["DATE","MM/dd/YYYY HH:mm:ss"]  
> target =\> "@timestamp"  
> }  
> mutate {convert =\> ["MAX", "float"]}  
> mutate {convert =\> ["JLU", "float"]}  
> mutate {convert =\> ["PEND", "float"]}  
> mutate {convert =\> ["RUN", "float"]}  
> mutate {convert =\> ["SUSP", "float"]}  
> }  
> output {  
> elasticsearch {  
> action =\> "index"  
> hosts =\> ["localhost:9201"]  
> index =\> "queue2"  
> workers =\> 1  
> }  
> stdout {}  
> }

CSV

> DATE,QUEUE,MAX,JLU,PEND,RUN,SUSP  
> 07/06/2017 10:05:16, x,3000,2000,0,500,0  
> 07/06/2017 10:05:16, y,1100,1000,0,58,0  
> 07/06/2017 10:05:16, z,4500,1600,92,1328,20  
> 07/06/2017 10:10:19, a,3000,2000,0,478,0  
> 07/06/2017 10:10:19, b,1100,1000,0,58,0  
> 07/06/2017 10:10:19, c,4500,1600,84,1328,20  
> 07/06/2017 10:15:32, a,3000,2000,0,440,0  
> 07/06/2017 10:15:32, c,1100,1000,0,58,0  
> 07/06/2017 10:15:32, d,4500,1600,76,1248,20

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 25, 2017, 9:05pm UTC](https://discuss.elastic.co/t/-dateparsefailure-error-despite-appearing-correctly/94260/2 "2017-07-25T21:05:54Z")

</div>

When Logstash adds the `_dateparsefailure` tag is also logs a message to indicate why it fails.

---

<div class="post-metadata">

**Author:** ![JohnWayne](https://avatars.discourse-cdn.com/v4/letter/j/a698b9/32.png) [@JohnWayne](https://discuss.elastic.co/u/JohnWayne)\
**Post date:** [July 26, 2017, 3:09am UTC](https://discuss.elastic.co/t/-dateparsefailure-error-despite-appearing-correctly/94260/3 "2017-07-26T03:09:31Z")

</div>

Hi Magnus,

How do I find out where and what the message is?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 26, 2017, 6:40am UTC](https://discuss.elastic.co/t/-dateparsefailure-error-despite-appearing-correctly/94260/4 "2017-07-26T06:40:50Z")

</div>

The first line containing headers will be the first event processed, and this should cause a `_dateparsefailure`, so you may need to drop this. You should be able to check if the first column contains the text `DATE` and then use a `drop` filter.

---

<div class="post-metadata">

**Author:** ![JohnWayne](https://avatars.discourse-cdn.com/v4/letter/j/a698b9/32.png) [@JohnWayne](https://discuss.elastic.co/u/JohnWayne)\
**Post date:** [July 26, 2017, 11:22am UTC](https://discuss.elastic.co/t/-dateparsefailure-error-despite-appearing-correctly/94260/5 "2017-07-26T11:22:52Z")

</div>

Hmm, well if you see my initial post, it shows that the column is there. Also, this is the exact same conf that I have going now to another index called "queue", and the format has not changed at all. The source (CSV) is different though.

* * *

## columns =\> ["DATE","QUEUE","MAX","JLU","PEND","RUN","SUSP"] } date { match =\> ["DATE","MM/dd/YYYY HH:mm:ss"]

## DATE,QUEUE,MAX,JLU,PEND,RUN,SUSP 07/06/2017 10:05:16, x,3000,2000,0,500,0

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 23, 2017, 11:22am UTC](https://discuss.elastic.co/t/-dateparsefailure-error-despite-appearing-correctly/94260/6 "2017-08-23T11:22:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.