# Can't replace timestamp , getting \[1\] "\_dateparsefailure" **URL:** \ **Category:** Logstash\ **Created:** [January 23, 2017, 6:03pm UTC](https://discuss.elastic.co/t/cant-replace-timestamp-getting-1--dateparsefailure/72520 "2017-01-23T18:03:06Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![irom77](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/irom77/32/12976_2.png) [@irom77](https://discuss.elastic.co/u/irom77)\ **Post date:** [January 23, 2017, 6:03pm UTC](https://discuss.elastic.co/t/cant-replace-timestamp-getting-1--dateparsefailure/72520/1 "2017-01-23T18:03:06Z")
I am getting [1] "\_dateparsefailure" when trying to replace timestamp My timestamp is **"@timestamp" =\> 2017-01-23T17:58:23.434Z** and I want to replace it by **"GenerateTime" =\> "2017/23/01 12:58:23"** from my input so I am using below date { timezone =\> "America/New\_York" match =\> ["GenerateTime", "YYYY/MM/dd HH:mm:ss"] target =\> "@timestamp" } but it gives me [1] "\_dateparsefailure" ? PS Also I don't understand why timestamp" is 2017-01-23T17:58:23.434Z not 2017/23/01 12:58:23 , 5h difference ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 23, 2017, 9:25pm UTC](https://discuss.elastic.co/t/cant-replace-timestamp-getting-1--dateparsefailure/72520/2 "2017-01-23T21:25:40Z")
> but it gives me [1] "\_dateparsefailure" ? Is your input really "2017/23/01 12:58:23"? If so it's YYYY/dd/MM and not YYYY/MM/dd. > Also I don't understand why timestamp" is 2017-01-23T17:58:23.434Z not 2017/23/01 12:58:23 , 5h difference The `@timestamp` field is always UTC. ---
**Author:** ![irom77](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/irom77/32/12976_2.png) [@irom77](https://discuss.elastic.co/u/irom77)\ **Post date:** [January 23, 2017, 9:31pm UTC](https://discuss.elastic.co/t/cant-replace-timestamp-getting-1--dateparsefailure/72520/3 "2017-01-23T21:31:50Z")
Now it matches 🙂 I verified it multiple times, just haven't noticed the mistake ...Thnx again !!! ---
**Author:** ![irom77](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/irom77/32/12976_2.png) [@irom77](https://discuss.elastic.co/u/irom77)\ **Post date:** [January 23, 2017, 10:22pm UTC](https://discuss.elastic.co/t/cant-replace-timestamp-getting-1--dateparsefailure/72520/4 "2017-01-23T22:22:29Z")
Sorry, one more thin, do you know why it is "@timestamp":"2017-01-23T05:19:49.000Z" so 05:19 instead of 17:19 ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 24, 2017, 6:28am UTC](https://discuss.elastic.co/t/cant-replace-timestamp-getting-1--dateparsefailure/72520/5 "2017-01-24T06:28:47Z")
> Sorry, one more thin, do you know why it is "@timestamp":"2017-01-23T05:19:49.000Z" so 05:19 instead of 17:19 ? What's the exact input string and what date pattern are you using? ---
**Author:** ![irom77](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/irom77/32/12976_2.png) [@irom77](https://discuss.elastic.co/u/irom77)\ **Post date:** [January 24, 2017, 12:50pm UTC](https://discuss.elastic.co/t/cant-replace-timestamp-getting-1--dateparsefailure/72520/6 "2017-01-24T12:50:26Z")
Input string is i.e. all dates like _2017/20/01 13:53:35_ I am using **bold** one in above 'date' after 'csv' > \<141\>Nov 3 12:53:35 DC1. 1,2017/20/01 13:53:35,001901000999,THREAT,file,1, **2017/20/01 13:53:35** ,1.1.1.1,2.2.2.2,0.0.0.0,0.0.0.0,RULE fake,me,,APP test,vsys1,app,rep,ae1.2,ae2.1,LF-elk,2017/20/01 13:53:35,33891243,1,445,66666,0,0,0x0,tcp,test,"WebFix.exe",Microsoft PE File(52060),any,low,server-to-client,5210010,0x0,10.0.0.0-10.255.255.255,10.0.0.0-10.255.255.255,0,,0,,,0,,,,,,,,0,38,0,0,0,PROD,DC1, ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 24, 2017, 7:05pm UTC](https://discuss.elastic.co/t/cant-replace-timestamp-getting-1--dateparsefailure/72520/7 "2017-01-24T19:05:37Z")
I asked two questions earlier. Please answer both. Please also answer the following: - What's the resulting `@timestamp` value for the example input you've provided? - What's the timezone of the machine running Logstash? ---
**Author:** ![irom77](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/irom77/32/12976_2.png) [@irom77](https://discuss.elastic.co/u/irom77)\ **Post date:** [January 24, 2017, 7:15pm UTC](https://discuss.elastic.co/t/cant-replace-timestamp-getting-1--dateparsefailure/72520/8 "2017-01-24T19:15:37Z")
I did new test: 1. from stdout I can see "@timestamp" =\> 2017-01-24T02:10:53.000Z 2. from OS running logstash $ date Tue Jan 24 14:10:53 EST 2017 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 24, 2017, 7:35pm UTC](https://discuss.elastic.co/t/cant-replace-timestamp-getting-1--dateparsefailure/72520/9 "2017-01-24T19:35:28Z")
Please answer all questions I ask. The remaining one (last chance) is: What date pattern are you using? ---
**Author:** ![irom77](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/irom77/32/12976_2.png) [@irom77](https://discuss.elastic.co/u/irom77)\ **Post date:** [January 24, 2017, 7:42pm UTC](https://discuss.elastic.co/t/cant-replace-timestamp-getting-1--dateparsefailure/72520/10 "2017-01-24T19:42:47Z")
Here it is , I have timezone commented out > date { > #timezone =\> "America/New\_York" > match =\> ["GenerateTime", "YYYY/dd/MM HH:mm:ss"] > target =\> "@timestamp" > } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 24, 2017, 8:10pm UTC](https://discuss.elastic.co/t/cant-replace-timestamp-getting-1--dateparsefailure/72520/11 "2017-01-24T20:10:11Z")
Okay. Please show the output of this command: ``` echo '2017/20/01 13:53:35' | logstash -e 'input { stdin { } } output { stdout { codec => rubydebug } } filter { date { match => ["message", "YYYY/dd/MM HH:mm:ss"] } }' ``` (You may have to provide the full path to the Logstash binary.) ---
**Author:** ![irom77](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/irom77/32/12976_2.png) [@irom77](https://discuss.elastic.co/u/irom77)\ **Post date:** [January 24, 2017, 8:15pm UTC](https://discuss.elastic.co/t/cant-replace-timestamp-getting-1--dateparsefailure/72520/12 "2017-01-24T20:15:46Z")
That one looks good 🙂 What's going on ? { "@timestamp" =\> 2017-01-20T13:53:35.000Z, "@version" =\> "1", "host" =\> "01b23f0c8ad0", "message" =\> "2017/20/01 13:53:35" } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 24, 2017, 8:18pm UTC](https://discuss.elastic.co/t/cant-replace-timestamp-getting-1--dateparsefailure/72520/13 "2017-01-24T20:18:13Z")
Since 2017/20/01 13:53:35 is EST (right?) you need to specify the timezone so that `@timestamp` gets the correct UTC value, but yes, apart from the timezone offset things are okay. ---
**Author:** ![irom77](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/irom77/32/12976_2.png) [@irom77](https://discuss.elastic.co/u/irom77)\ **Post date:** [January 24, 2017, 8:20pm UTC](https://discuss.elastic.co/t/cant-replace-timestamp-getting-1--dateparsefailure/72520/14 "2017-01-24T20:20:13Z")
I can see now that thing sending to my input uses 12h format:tired\_face: ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 21, 2017, 8:20pm UTC](https://discuss.elastic.co/t/cant-replace-timestamp-getting-1--dateparsefailure/72520/15 "2017-02-21T20:20:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.