# CSV \_dateparsefailure

**URL:** <https://discuss.elastic.co/t/csv-dateparsefailure/129745>\
**Category:** Logstash\
**Created:** [April 26, 2018, 8:55pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure/129745 "2018-04-26T20:55:33Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![lowdmt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lowdmt/32/30300_2.png) [@lowdmt](https://discuss.elastic.co/u/lowdmt)\
**Post date:** [April 26, 2018, 8:55pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure/129745/1 "2018-04-26T20:55:33Z")

</div>

Hi,

I have an issue with \_dateparsefailure

#example from CSV FirstNotifiedAt 31/03/2018 23:58:00  
filter {  
date {  
match =\> ["FirstNotifiedAt", "dd/MM/yyyy HH:mm:ss"]  
target =\> "@timestamp"  
}  
}

The @timestamp in Kibana is still showing the time the CSV was imported and not the "FirstNotifiedAt" time that I'm looking for.

"fields": {  
"@timestamp": [  
"2018-04-26T20:47:01.136Z"  
]  
},

Any help appreciated

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [April 26, 2018, 9:09pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure/129745/2 "2018-04-26T21:09:52Z")

</div>

In the final event that was exported to Elasticsearch, what is the value of the `FirstNotifiedAt` field? I'm not seeing anything obvious from your pattern and the string you pasted in the comment above it 🤔

---

<div class="post-metadata">

**Author:** ![lowdmt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lowdmt/32/30300_2.png) [@lowdmt](https://discuss.elastic.co/u/lowdmt)\
**Post date:** [April 27, 2018, 12:39pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure/129745/3 "2018-04-27T12:39:12Z")

</div>

Hi,

I'm looking in Kibana in the JSON output

```
"snhZone": "Global",
"LastNotifiedAt": "02/01/2018 06:25",
"Owner": "SYSTEM",

```

If thats what you mean?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 27, 2018, 5:23pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure/129745/4 "2018-04-27T17:23:50Z")

</div>

Okay, that's the `LastNotifiedAt` field. What about `FirstNotifiedAt`?

---

<div class="post-metadata">

**Author:** ![lowdmt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lowdmt/32/30300_2.png) [@lowdmt](https://discuss.elastic.co/u/lowdmt)\
**Post date:** [April 27, 2018, 5:45pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure/129745/5 "2018-04-27T17:45:17Z")

</div>

Sorry pasted in the wrong one....although it's the same format.

```
"Event": "Down",
"FirstNotifiedAt": "01/01/2018 12:22",
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 27, 2018, 7:34pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure/129745/6 "2018-04-27T19:34:04Z")

</div>

The timestamp doesn't include seconds but your date pattern does.

---

<div class="post-metadata">

**Author:** ![lowdmt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lowdmt/32/30300_2.png) [@lowdmt](https://discuss.elastic.co/u/lowdmt)\
**Post date:** [April 27, 2018, 8:16pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure/129745/7 "2018-04-27T20:16:55Z")

</div>

removing the :ss worked. Sort of.

I think this is an issue in the way the csv is produced.

It's a little peculiar as the csv shows the FirstNotifiedAt as a 'custom' format in excel. It is formatted 31/03/2018 23:56:00

1. There is a double space between date and time
2. There is a :ss

I haven't changed the csv (the export from the software needs to be automated and altering the csv format is a non starter)...losing the :ss isn't critical for my purposes so I guess I'm happy.

},  
"fields": {  
"@timestamp": [  
"2018-02-24T13:26:00.000Z"

Thanks Magnus

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 25, 2018, 8:16pm UTC](https://discuss.elastic.co/t/csv-dateparsefailure/129745/8 "2018-05-25T20:16:59Z")

</div>

Closed on May 25, 2018, 8:16pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.