# Dataparsefailure problem

**URL:** <https://discuss.elastic.co/t/dataparsefailure-problem/129426>\
**Category:** Logstash\
**Created:** [April 25, 2018, 7:46am UTC](https://discuss.elastic.co/t/dataparsefailure-problem/129426 "2018-04-25T07:46:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![chenzilong444](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\
**Post date:** [April 25, 2018, 7:46am UTC](https://discuss.elastic.co/t/dataparsefailure-problem/129426/1 "2018-04-25T07:46:00Z")

</div>

```
filter {
    grok{
        match => [
            "message","\s*(\[(?<key1>[^:\]]*):(?<value1>[^\]]*)\])?"
                 ]
    }
    if [key1]{
			if [key1]=~ ".*Float\b"{
				mutate {
					convert => ["value1", "float"]
				}
				mutate {
					rename => ["value1", "%{key1}"]
				}
			}
			else{
				mutate{
						add_field => {
					        "%{key1}" => "%{value1}"
				        }
						remove_field => "value1"
				}
			}
			mutate{
				remove_field => "key1"
			}
	}
	if [TimeStamp]{
		grok{
			match => [
				"TimeStamp","%{TIMESTAMP_ISO8601:timestamp}"
			]
		}
		grok{
			match => [
				"timestamp","(?<indextime>[^\s]*)"
			]
		}
		mutate{
			add_field =>{
				"[@metadata][indexDate]" => "%{indextime}"
			}
		}	
		date {
			match => ["timestamp", "ISO8601"]
			target => "TS"
			locale => "en"
			}
# mutate{
# remove_field => "timestamp"
# }
	}
}

```

when i input that  
[TimeStamp:2018-02-02 11:59:31]  
{  
"indextime" =\> "2018-02-02",  
"@timestamp" =\> 2018-04-25T07:43:07.548Z,  
"tags" =\> [  
[0] "\_dateparsefailure"  
],  
"@version" =\> "1",  
"message" =\> "[TimeStamp:2018-02-02 11:59:31]\r",  
"host" =\> "BIH-D-6331",  
"TimeStamp" =\> "2018-02-02 11:59:31",  
"timestamp" =\> "2018-02-02 11:59:31"  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 25, 2018, 11:29am UTC](https://discuss.elastic.co/t/dataparsefailure-problem/129426/2 "2018-04-25T11:29:54Z")

</div>

I'm not sure ISO8601 works in this case. Try "YYYY-MM-dd HH:mm:ss" instead.

---

<div class="post-metadata">

**Author:** ![chenzilong444](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\
**Post date:** [April 25, 2018, 11:42am UTC](https://discuss.elastic.co/t/dataparsefailure-problem/129426/3 "2018-04-25T11:42:23Z")

</div>

perfect answer！ thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 23, 2018, 11:42am UTC](https://discuss.elastic.co/t/dataparsefailure-problem/129426/4 "2018-05-23T11:42:27Z")

</div>

Closed on May 23, 2018, 11:42am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.