# Data parse error \["\_dateparsefailure"\] **URL:** \ **Category:** Logstash\ **Created:** [July 13, 2018, 10:48am UTC](https://discuss.elastic.co/t/data-parse-error-dateparsefailure/139924 "2018-07-13T10:48:09Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Gokul\_15](https://avatars.discourse-cdn.com/v4/letter/g/5f9b8f/32.png) [@Gokul\_15](https://discuss.elastic.co/u/Gokul_15)\ **Post date:** [July 13, 2018, 10:48am UTC](https://discuss.elastic.co/t/data-parse-error-dateparsefailure/139924/1 "2018-07-13T10:48:09Z")
data parse error ["\_dateparsefailure"] filter{ ``` date{ match=>["date","yyyy-MM-dd HH:mm:ss:SSS Z"] target=>"logdata" } ``` mutate { remove\_field =\> ["date"] } where date inside the match is the field in db.. "date":"2018-07-09T06:36:44.254Z" ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 13, 2018, 11:37am UTC](https://discuss.elastic.co/t/data-parse-error-dateparsefailure/139924/2 "2018-07-13T11:37:48Z")
Your pattern clearly doesn't match the actual timestamp. Try using `ISO8601` as the date pattern. If that doesn't work use `YYYY-MM-dd'T'HH:mm:ss.SSS'Z'`. Remember to also set `timezone => "UTC"`. ---
**Author:** ![Gokul\_15](https://avatars.discourse-cdn.com/v4/letter/g/5f9b8f/32.png) [@Gokul\_15](https://discuss.elastic.co/u/Gokul_15)\ **Post date:** [July 16, 2018, 7:08am UTC](https://discuss.elastic.co/t/data-parse-error-dateparsefailure/139924/3 "2018-07-16T07:08:30Z")
still it is not resolved.. "@timestamp" =\> 2018-07-16T07:06:29.777Z, "uid" =\> 14, "tags" =\> [ [0] "\_dateparsefailure" ], "first\_name" =\> "e", "last\_name" =\> "e", "@version" =\> "1", "email" =\> "en@example.com" ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 16, 2018, 6:36pm UTC](https://discuss.elastic.co/t/data-parse-error-dateparsefailure/139924/4 "2018-07-16T18:36:51Z")
If the date filter fails to parse a timestamp it'll log a message about it in the Logstash log. Find that message and post it along with your current configuration. ---
**Author:** ![Gokul\_15](https://avatars.discourse-cdn.com/v4/letter/g/5f9b8f/32.png) [@Gokul\_15](https://discuss.elastic.co/u/Gokul_15)\ **Post date:** [July 17, 2018, 4:39am UTC](https://discuss.elastic.co/t/data-parse-error-dateparsefailure/139924/5 "2018-07-17T04:39:45Z")
this is what showing in logstash .. "tags" =\> [ [0] "\_dateparsefailure" ], ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 17, 2018, 11:30am UTC](https://discuss.elastic.co/t/data-parse-error-dateparsefailure/139924/6 "2018-07-17T11:30:41Z")
No, I'm talking about Logstash's own log file, typically named logstash-plain.log. ---
**Author:** ![Gokul\_15](https://avatars.discourse-cdn.com/v4/letter/g/5f9b8f/32.png) [@Gokul\_15](https://discuss.elastic.co/u/Gokul_15)\ **Post date:** [July 17, 2018, 11:48am UTC](https://discuss.elastic.co/t/data-parse-error-dateparsefailure/139924/7 "2018-07-17T11:48:02Z")
i have used simple stdout{} ..it displays as follows in logstash-plain: [2018-07-17T17:13:01,258][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified [2018-07-17T17:13:01,941][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.3.0"} [2018-07-17T17:13:09,072][INFO][logstash.pipeline] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50} [2018-07-17T17:13:09,963][INFO][logstash.pipeline] Pipeline started successfully {:pipeline\_id=\>"main", :thread=\>"#\"} [2018-07-17T17:13:10,101][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>[]} [2018-07-17T17:13:10,502][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2018-07-17T17:14:03,192][INFO][logstash.inputs.jdbc] (0.251407s) SELECT CAST(current\_setting('server\_version\_num') AS integer) AS v [2018-07-17T17:14:03,562][INFO][logstash.inputs.jdbc] (0.130932s) SELECT count(\*) AS "count" FROM (SELECT \* from contacts WHERE date between '2017-07-17 10:24:00.394000+0530' and CURRENT\_TIMESTAMP ) AS "t1" LIMIT 1 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 17, 2018, 4:56pm UTC](https://discuss.elastic.co/t/data-parse-error-dateparsefailure/139924/8 "2018-07-17T16:56:50Z")
I'm guessing you're hitting this issue: [https://github.com/logstash-plugins/logstash-filter-date/issues/95](https://github.com/logstash-plugins/logstash-filter-date/issues/95) ---
**Author:** ![Gokul\_15](https://avatars.discourse-cdn.com/v4/letter/g/5f9b8f/32.png) [@Gokul\_15](https://discuss.elastic.co/u/Gokul_15)\ **Post date:** [July 18, 2018, 4:40am UTC](https://discuss.elastic.co/t/data-parse-error-dateparsefailure/139924/9 "2018-07-18T04:40:32Z")
converting date to string and then parse with date method works for me filter { mutate { convert =\> {"log\_date" =\> "string"} } date { match =\> ["log\_date", "ISO8601"] } } ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 15, 2018, 4:40am UTC](https://discuss.elastic.co/t/data-parse-error-dateparsefailure/139924/10 "2018-08-15T04:40:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.