# Another timestamp parsing question

**URL:** <https://discuss.elastic.co/t/another-timestamp-parsing-question/91908>\
**Category:** Logstash\
**Created:** [July 5, 2017, 1:11pm UTC](https://discuss.elastic.co/t/another-timestamp-parsing-question/91908 "2017-07-05T13:11:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dee/32/18876_2.png) [@Dee](https://discuss.elastic.co/u/Dee)\
**Post date:** [July 5, 2017, 1:11pm UTC](https://discuss.elastic.co/t/another-timestamp-parsing-question/91908/1 "2017-07-05T13:11:51Z")

</div>

Hi,  
I have this time format:  
0705 16:06:23.522

This is my logstash configuration:

> ```
> json {
> source => "event"
> }
> date {
> match => ["time", "MMdd HH:mm:ss.SSS"]
> remove_field => ["time"]
> }
> 
> ```

I get the exception:

> {:timestamp=\>"2017-07-05T16:06:32.268000+0300", :message=\>"Error parsing @timestamp string, setting current time to @timestamp, original in \_@timestamp field", :value=\>""0705 16:06:23.522"", :exception=\>"invalid timestamp string "0705 16:06:23.522", error=java.lang.IllegalArgumentException: Invalid format: "0705 16:06:23.522" is malformed at " 16:06:23.522"", :level=\>:warn}

Can anyone enlighten me of this exception? The pattern should match and I confirmed it using this debugger: [https://joda-time-parse-debugger.herokuapp.com/](https://joda-time-parse-debugger.herokuapp.com/)  
And I know for a fact that its trying to use this match. When I change it to a wrong format the exception says so.

Thanks,  
Diana.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 2, 2017, 1:11pm UTC](https://discuss.elastic.co/t/another-timestamp-parsing-question/91908/2 "2017-08-02T13:11:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
