# Another EPOCH time dateparse failure

**URL:** <https://discuss.elastic.co/t/another-epoch-time-dateparse-failure/106893>\
**Category:** Logstash\
**Created:** [November 8, 2017, 3:14pm UTC](https://discuss.elastic.co/t/another-epoch-time-dateparse-failure/106893 "2017-11-08T15:14:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![guruprasadh4](https://avatars.discourse-cdn.com/v4/letter/g/cab0a1/32.png) [@guruprasadh4](https://discuss.elastic.co/u/guruprasadh4)\
**Post date:** [November 8, 2017, 3:14pm UTC](https://discuss.elastic.co/t/another-epoch-time-dateparse-failure/106893/1 "2017-11-08T15:14:12Z")

</div>

**Sample Log file-**  
IDENTIFIER TIMESTAMP T C RESOURCE\_NAME DESCRIPTION  
C6E26F3B 1002042417 I H hdisk111 BACK-UP PATH STATUS CHANGE  
C6E26F3B 1002042417 I H hdisk103 BACK-UP PATH STATUS CHANGE

**Logstash config file-**  
input {  
file {  
path =\> "/home/elkuser/KP/LogData/errpt/server\_lun\_info1.log"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
codec =\> multiline {  
pattern =\> "^\A%{HOSTNAME:IDENTIFIER}%{SPACE}%{NUMBER:TIMESTAMP}"  
negate =\> "true"  
what =\> "previous"  
max\_lines =\> 1000  
}  
}  
}  
filter  
{  
grok { match =\> ["message", "\A%{HOSTNAME:IDENTIFIER}%{SPACE}+%{NUMBER:TIMESTAMP}%{SPACE}+%{PROG:T}%{SPACE}+%{PROG:C}%{SPACE}+%{PROG:TIMESTAMP}%{SPACE}+%{GREEDYDATA:DESCRIPTION}"]  
overwrite =\> ["message"]  
}  
mutate {  
convert =\> {"TIMESTAMP" =\> "integer"}  
}  
date{ match =\> ["TIMESTAMP", "UNIX"]  
target =\> "TIMESTAMP"  
}  
}  
output {  
elasticsearch {  
hosts =\> "9.109.184.72:9200"  
index =\> "kp-epims-errpt"  
template\_overwrite =\> true  
}  
stdout {  
codec =\> rubydebug  
}  
}

**Error Message:**

```
   "path" => "/home/elkuser/KP/LogData/errpt/server_lun_info1.log",
 "@timestamp" => 2017-11-08T15:02:13.012Z,
          "C" => "S",
          "T" => "T",
"DESCRIPTION" => "SOFTWARE PROGRAM ERROR",
  "TIMESTAMP" => [
    [0] 1001234217,
    [1] 0
],
   "@version" => "1",
       "host" => "analyticslab72.in.ibm.com",
 "IDENTIFIER" => "DC73C03A",
    "message" => "DC73C03A 1001234217 T S fscsi2 SOFTWARE PROGRAM ERROR",
       "tags" => [
    [0] "_dateparsefailure"
]

```

}  
{  
"path" =\> "/home/elkuser/KP/LogData/errpt/server\_lun\_info1.log",  
"@timestamp" =\> 2017-11-08T15:02:13.012Z,  
"C" =\> "S",  
"T" =\> "T",  
"DESCRIPTION" =\> "SOFTWARE PROGRAM ERROR",  
"TIMESTAMP" =\> [  
[0] 1001234217,  
[1] 0  
],  
"@version" =\> "1",  
"host" =\> "[analyticslab72.in.ibm.com](http://analyticslab72.in.ibm.com)",  
"IDENTIFIER" =\> "DC73C03A",  
"message" =\> "DC73C03A 1001234217 T S fscsi2 SOFTWARE PROGRAM ERROR",  
"tags" =\> [  
**[0] "\_dateparsefailure"**

Please review and let me know further.

Thanks!

---

<div class="post-metadata">

**Author:** ![guruprasadh4](https://avatars.discourse-cdn.com/v4/letter/g/cab0a1/32.png) [@guruprasadh4](https://discuss.elastic.co/u/guruprasadh4)\
**Post date:** [November 8, 2017, 6:48pm UTC](https://discuss.elastic.co/t/another-epoch-time-dateparse-failure/106893/2 "2017-11-08T18:48:35Z")

</div>

Well never mind, this one I was able to fix.  
Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 6, 2017, 6:48pm UTC](https://discuss.elastic.co/t/another-epoch-time-dateparse-failure/106893/3 "2017-12-06T18:48:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.