# CSV \_dateparsefailure error **URL:** \ **Category:** Logstash\ **Created:** [February 28, 2019, 7:53pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure-error/170401 "2019-02-28T19:53:08Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![devmal044](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devmal044/32/41840_2.png) [@devmal044](https://discuss.elastic.co/u/devmal044)\ **Post date:** [February 28, 2019, 7:53pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure-error/170401/1 "2019-02-28T19:53:09Z")
Not sure whats going on but I keep getting a dateparsefailure tag on all my data that comes in. Ive tried this on two different ELk instances and I still get the tag attached to my data. Any idea whats going on? I have a sample entry from the CSV below as well as the filter for this data. Sample Entry: wannacry,5b38202756b09192cfbdf758c5540579,7d0a15034243f3eb3748b011c2a293e0c436d4e2,a6af49137e4924ee3af1a16ff004e7b9e1fbe1c32adb4797d98e07e6088b16e0,52,Win32 DLL,5384861005840384,2019-02-27 21:19:58 Snippet of filter from config file: ... if "rss" in [tags] { csv { columns =\> ["family","md5","sha1","sha256","positives","file\_type","id","date"] } date { match =\> ["date", "yyyy MM dd HH:mm:ss", "yyyy-MM-dd HH:mm:ss"] timezone =\> "UTC" } } ... ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 28, 2019, 9:11pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure-error/170401/2 "2019-02-28T21:11:38Z")
Are you sure that is the only date filter in the configuration? ---
**Author:** ![devmal044](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devmal044/32/41840_2.png) [@devmal044](https://discuss.elastic.co/u/devmal044)\ **Post date:** [March 4, 2019, 4:12pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure-error/170401/3 "2019-03-04T16:12:41Z")
On the PROD instance, there are two date filters but they are contained in if statements for different indexes shown below: filter { if "hashes" in [tags] { csv { columns =\> ["tag", "date", "hash"] } date { match =\> ["date", "yyyy MMM dd HH:mm:ss"] timezone =\> "America/Chicago" } } if "rss" in [tags] { csv { columns =\> ["family","md5","sha1","sha256","positives","file\_type","id","date"] } date { match =\> ["date", "yyyy MM dd HH:mm:ss", "yyyy-MM-dd HH:mm:ss"] timezone =\> "UTC" } } } The top "if" works fine but the bottom doesn't work at all and I'm really not sure why. Do I need to chance "MM" to "MMM"? I've tried echoing the date into logstash via the command line with my conf file but that just keeps erroring out. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 4, 2019, 4:27pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure-error/170401/4 "2019-03-04T16:27:50Z")
Does an event ever have both tags? ---
**Author:** ![devmal044](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devmal044/32/41840_2.png) [@devmal044](https://discuss.elastic.co/u/devmal044)\ **Post date:** [March 4, 2019, 4:30pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure-error/170401/5 "2019-03-04T16:30:21Z")
They shouldn't, I assign the tags depending on which csv the data comes from. Input and output are shown below: Input: input { file { path =\> "/dir/dir/dir/dir/trendsv2.csv" start\_position =\> "beginning" sincedb\_path =\> "/dev/null/" tags =\> 'hashes' } ``` file { path => "/dir/dir/dir/dir/rss_feed/trendsv3.csv" start_position => "beginning" sincedb_path => "/dev/null/" tags => 'rss' } } ``` Output: output { if "hashes" in [tags] { elasticsearch { hosts =\> "localhost:9200" index =\> "hashes" document\_type =\> "malware\_trends" } } if "rss" in [tags] { elasticsearch { hosts =\> "localhost:9200" index =\> "rss\_feed" document\_type =\> "malware\_trends" } } stdout {} } ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 4, 2019, 4:50pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure-error/170401/6 "2019-03-04T16:50:06Z")
Can you show a sample event that gets written to stdout with a \_dateparsefailure tag? ---
**Author:** ![devmal044](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devmal044/32/41840_2.png) [@devmal044](https://discuss.elastic.co/u/devmal044)\ **Post date:** [March 4, 2019, 7:37pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure-error/170401/7 "2019-03-04T19:37:54Z")
This is what I am seeing in my syslog. I expect the second message since it is the header of the csv file. Ill get them from the PROD instance here in a bit. ``` Mar 4 10:56:16 ubuntu logstash[6201]:[1] "_dateparsefailure" Mar 4 11:20:43 ubuntu logstash[6201]: [2019-03-04T11:20:43,082][DEBUG][logstash.pipeline] output received {"event"=>{"file_type"=>"type", "@timestamp"=>2019-03-04T19:20:42.263Z, "sha1"=>"sha1", "family"=>"tag", "md5"=>"md5", "host"=>"ubuntu", "date"=>"date", "sha256"=>"sha256", "path"=>"/home/dev/trends/trendsv3.csv", "message"=>"tag,md5,sha1,sha256,positives,type,id,date\r", "tags"=>["rss", "_dateparsefailure"], "@version"=>"1", "id"=>"id", "positives"=>"positives"}} Mar 4 11:20:44 ubuntu logstash[6201]:[1] "_dateparsefailure" Mar 4 10:56:06 ubuntu logstash[6201]: [2019-03-04T10:56:06,025][DEBUG][logstash.filters.date] config LogStash::Filters::Date/@tag_on_failure = ["_dateparsfailure"] ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 4, 2019, 8:13pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure-error/170401/8 "2019-03-04T20:13:16Z")
For the header row I would expect to get the \_dateparsefailure. ---
**Author:** ![devmal044](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devmal044/32/41840_2.png) [@devmal044](https://discuss.elastic.co/u/devmal044)\ **Post date:** [March 4, 2019, 8:59pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure-error/170401/9 "2019-03-04T20:59:33Z")
Well Badger, it looks like everything is working fine now. I really have no clue what was going on. These were the last dateparsefailure errors I received in the syslog on the PROD instance when I copied the conf file from the test instance. ``` Mar 4 14:49:10 PRODBOX logstash[13570]: [2019-03-04T14:49:10,247][DEBUG][logstash.pipeline] output received {"event"=>{"message"=>"family,md5,sha1,sha256,positives,type,id,date\r", "sha256"=>"sha256", "path"=>"/dir/dir/dir/dir/trendsv3.csv", "@timestamp"=>2019-03-04T20:49:09.096Z, "md5"=>"md5", "host"=>"PRODBOX", "@version"=>"1", "family"=>"family", "date"=>"date", "tags"=>["rss", "_dateparsefailure"], "sha1"=>"sha1", "id"=>"id", "positives"=>"positives", "file_type"=>"type"}} Mar 4 14:49:11 PRODBOX logstash[13570]: [1] "_dateparsefailure" Mar 4 14:49:12 PRODBOX logstash[13570]: [1] "_dateparsefailure" ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 1, 2019, 8:59pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure-error/170401/10 "2019-04-01T20:59:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.