# Dataparse failures
**URL:** https://discuss.elastic.co/t/dataparse-failures/139045
**Category:** Logstash
**Created:** [July 8, 2018, 10:04am UTC](https://discuss.elastic.co/t/dataparse-failures/139045 "2018-07-08T10:04:16Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@heskez](https://discuss.elastic.co/u/heskez)
#### Post date: [July 8, 2018, 10:04am UTC](https://discuss.elastic.co/t/dataparse-failures/139045/1 "2018-07-08T10:04:16Z")
Hi I'm getting dataparse failure errors because of invalid timestamp format:
fortigate\_subtype:%{subtype} host:192.168.1.1 logTimestamp:%{date} %{time} @version:1 syslog5424\_pri:188 fortigate\_type:syslog message:%COPY-W-TRAP: The mirror-config file is illegal due to failure of previous copy operation/s to mirror-config. tags:\_dateparsefailure syslog\_index:\<188\> @timestamp:July 8th 2018, 11:39:14.487 loglevel:%{level} \_id:\_P1CeWQB1oi6Il\_pcDdF \_type:doc \_index:logstash-syslog \_score: -
This is my filter:
input {
udp {
port =\> 5514
type =\> syslog
}
tcp {
port =\> 5514
type =\> syslog
}
}
filter {
```
grok {
patterns_dir => ["/etc/logstash/patterns"]
match => ["message", "%{SYSLOG5424PRI:syslog_index}%{GREEDYDATA:message}"]
overwrite => ["message"]
tag_on_failure => ["failure_grok_fortigate"]
}
kv { }
if [msg] {
mutate {
replace => ["message", "%{msg}"]
}
}
mutate {
add_field => ["logTimestamp", "%{date} %{time}"]
add_field => ["loglevel", "%{level}"]
replace => ["fortigate_type", "%{type}"]
replace => ["fortigate_subtype", "%{subtype}"]
remove_field => ["msg", "type", "level", "date", "time"]
}
date {
locale => "en"
match => ["logTimestamp", "YYYY-MM-dd HH:mm:ss"]
remove_field => ["logTimestamp", "year", "month", "day", "time", "date"]
add_field => ["type", "syslog"]
}
```
}
output {
elasticsearch { hosts =\> ["localhost:9200"] index =\> "logstash-syslog" }
stdout { codec =\> rubydebug }
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 8, 2018, 7:01pm UTC](https://discuss.elastic.co/t/dataparse-failures/139045/2 "2018-07-08T19:01:51Z")
The `logTimestamp` field contains "%{date} %{time}" which obviously can't be parsed. This indicates that there were no `date` and `time` fields when you created the `logTimestamp` field. When were those two fields supposed to be created?
---
### Author:  [@heskez](https://discuss.elastic.co/u/heskez)
#### Post date: [July 9, 2018, 8:49pm UTC](https://discuss.elastic.co/t/dataparse-failures/139045/3 "2018-07-09T20:49:28Z")
Thanks for your answer. I think %date and time is based on an assumption these are the right fields. But basically I'm looking for the right syntax to have a date and time parsed.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 9, 2018, 9:18pm UTC](https://discuss.elastic.co/t/dataparse-failures/139045/4 "2018-07-09T21:18:31Z")
There's no reason to make any assumptions when it's so easy to observe reality. Use a `stdout { codec => rubydebug }` output to make Logstash dump the raw events it processes. If you do that I'm pretty sure you'll note that you don't have any of the fields you think you have. The only thing your grok filter does is strip the syslog priority prefix string from the syslog payload. You're not extracting the timestamp or anything else into fields. The Logstash documentation has a page with a couple of complete configuration examples, one of them of syslog parsing.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 6, 2018, 9:18pm UTC](https://discuss.elastic.co/t/dataparse-failures/139045/5 "2018-08-06T21:18:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.