# Can't parse timestamp to @timestamp **URL:** \ **Category:** Logstash\ **Created:** [February 7, 2017, 9:54pm UTC](https://discuss.elastic.co/t/cant-parse-timestamp-to-timestamp/74289 "2017-02-07T21:54:22Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![pgrzec2s](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pgrzec2s/32/14345_2.png) [@pgrzec2s](https://discuss.elastic.co/u/pgrzec2s)\ **Post date:** [February 7, 2017, 9:54pm UTC](https://discuss.elastic.co/t/cant-parse-timestamp-to-timestamp/74289/1 "2017-02-07T21:54:23Z")
Hello Folks... i am sorry for that Question, i saw a lot of topics about the same problem, but there isn't one which is helpfull in my case. In Logstash i would like to parse my timestamp to @timestamp but i receive a \__dateparsefailure_. This is my Log: `129.70.76.43 - - [03/Jan/2017:14:39:38 +0100] "GET /resources/mail.png HTTP/1.1" 304 181 "http://www.jrabar.kuchen/qukkkkkkmaneeent/weirtecung-rofldiekatz.html" "Mozilla/5.0 (Windows NT 6.1; rv:50.0) Gecko/20100101 Firefox/50.0"` This is my config for Logstash: ...input .... ``` filter { if [type] == "apache-access" { grok { match => { "message" => "%{COMBINEDAPACHELOG}" } } date { match => ["timestamp", "dd/MM/YYYY:HH:mm:ss Z"] } } } output { stdout { } elasticsearch { } } ``` I know, that my Logfile has three letters for the month. Shouldn't be the matching option something like this? `match => ["timestamp", "dd/ **MMM** /YYYY:HH:mm:ss Z"]` If i use MMM, i receive a \_grokeparsingfailure Can someone give me a hint? For my understanding: parsing the timestamp with date is usefull, so the date of the event in the log will be the same as in elasticsearch. Furthermore, it gives me the possibilty to search with it, am I right? In addition, is there somewhere a videotutorial about "how to use grok/how to parse and index logs"? For me, all the regular expressions are looking highly complicated. Even with my "Logstash"-Book and the Grok Debugger i am feeling like "bruteforcing" a correct configuration for the filter. 😞 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 8, 2017, 7:00am UTC](https://discuss.elastic.co/t/cant-parse-timestamp-to-timestamp/74289/2 "2017-02-08T07:00:13Z")
> I know, that my Logfile has three letters for the month. Shouldn't be the matching option something like this? Yes, you need MMM. > If i use MMM, i receive a \_grokeparsingfailure No. Changing the date filter configuration does not affect the preceding grok filter. Show us the event that got the `_grokparsefailure` tag. You can copy/paste from the JSON tab in Kibana. ---
**Author:** ![pgrzec2s](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pgrzec2s/32/14345_2.png) [@pgrzec2s](https://discuss.elastic.co/u/pgrzec2s)\ **Post date:** [February 8, 2017, 8:07am UTC](https://discuss.elastic.co/t/cant-parse-timestamp-to-timestamp/74289/3 "2017-02-08T08:07:44Z")
changed config to `match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]` ``` { "_index": "logstash-2017.02.08", "_type": "apache-access", "_id": "AVocvv1OD35rHpO5agFt", "_score": null, "_source": { "path": "/home/grzechca/log/access/neuAccess.log", "@timestamp": "2017-02-08T08:02:43.028Z", "@version": "1", "host": "elkelastic", "message": "91.55.213.178 - - [03/Jan/2017:14:39:56 +0100] \"GET /images/jv_employer/1/6/4/5/3/logo_image_path/standart/blabla.png HTTP/1.1\" 200 11220 \"http://www.jrabar.kuchen/qukkkkkkmaneeent/biologie-life-sciences/wissenschaftlrofldiekatz.html\" \"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 S", "type": "apache-access", "tags": [ "_grokparsefailure" ] }, "fields": { "@timestamp": [ 1486540963028 ] }, "sort": [ 1486540963028 ] } ``` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 8, 2017, 8:50am UTC](https://discuss.elastic.co/t/cant-parse-timestamp-to-timestamp/74289/4 "2017-02-08T08:50:20Z")
The log line in your example ends like this: ``` "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 S ``` This is clearly garbage. The grok filter fails because the double quote is never closed. Double check what the input file looks like. ---
**Author:** ![pgrzec2s](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pgrzec2s/32/14345_2.png) [@pgrzec2s](https://discuss.elastic.co/u/pgrzec2s)\ **Post date:** [February 8, 2017, 9:59am UTC](https://discuss.elastic.co/t/cant-parse-timestamp-to-timestamp/74289/5 "2017-02-08T09:59:48Z")
Well, sorry about that. It seems, that i get only events listed who failed to parse, like my example. All the other events with logs like this example `193.196.237.20 - - [03/Jan/2017:15:01:01 +0100] "GET /resources/zu_styles/om/ghrt920.jpg?1454460 HTTP/1.1" 304 182 "http://www.jrabar,kuchen/resources/jr_styles/stylesheets/styles.css?v=20161231" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0"` are going well through stdout, but i can't see them in kibana \>.\< ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 8, 2017, 10:08am UTC](https://discuss.elastic.co/t/cant-parse-timestamp-to-timestamp/74289/6 "2017-02-08T10:08:46Z")
Are you looking at the correct date range in Kibana? Are you sure they aren't ending up in the wrong index? Is there anything interesting in the Logstash logs? ---
**Author:** ![pgrzec2s](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pgrzec2s/32/14345_2.png) [@pgrzec2s](https://discuss.elastic.co/u/pgrzec2s)\ **Post date:** [February 8, 2017, 11:33am UTC](https://discuss.elastic.co/t/cant-parse-timestamp-to-timestamp/74289/7 "2017-02-08T11:33:22Z")
I am rly thankful for your hint. Some logs were wrong and thats the reason why I only saw the "\_grokparsedfailure"-logs in kibana. Because of that, I thought I did a mistake. In addition, the timestamp is working for the right-parsed files. Thank you very much for your fast respond and sorry for "spaming" the forum with thislow-level issue. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 8, 2017, 11:33am UTC](https://discuss.elastic.co/t/cant-parse-timestamp-to-timestamp/74289/8 "2017-03-08T11:33:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.