# Cannot parse empty date

**URL:** https://discuss.elastic.co/t/cannot-parse-empty-date/320575
**Category:** Logstash
**Created:** [December 6, 2022, 12:17pm UTC](https://discuss.elastic.co/t/cannot-parse-empty-date/320575 "2022-12-06T12:17:10Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)
#### Post date: [December 6, 2022, 12:45pm UTC](https://discuss.elastic.co/t/cannot-parse-empty-date/320575/2 "2022-12-06T12:45:51Z")

</div>

To confirm, are you only receiving this error for events where `datBirth` is empty, and parsing is successful when it's populated?

If so you could try specifying zero or one occurrences using the ? operator, as per the below:

> [@Making a part in the grok expression optional](https://discuss.elastic.co/t/making-a-part-in-the-grok-expression-optional/43961):
>
> Hi all, Each line in my log file does not contain a source IP adderss so the "message" =\> "%{TIMESTAMP\_ISO8601:timestamp}\s+%{LOGLEVEL:loglevel}\s+%{THREAD:thread}\s+(?:%{IP:ip})" so it returns a "no mach" - from grok debugger. As result the the fields that I'm expecting to be created by the grok{} is not happening. So we tried to make the pattern for IP in this expression something like : match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:timestamp}\s+%{LOGLEVEL:loglevel}\s+%{THREAD:thread}…

---

_[View the full topic](https://discuss.elastic.co/t/cannot-parse-empty-date/320575)._