# Date filter not parsing **URL:** \ **Category:** Logstash\ **Created:** [August 23, 2016, 5:36am UTC](https://discuss.elastic.co/t/date-filter-not-parsing/58644 "2016-08-23T05:36:39Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![ash.vaidya94](https://avatars.discourse-cdn.com/v4/letter/a/aca169/32.png) [@ash.vaidya94](https://discuss.elastic.co/u/ash.vaidya94)\ **Post date:** [August 23, 2016, 5:36am UTC](https://discuss.elastic.co/t/date-filter-not-parsing/58644/1 "2016-08-23T05:36:39Z")
Hi all, I've been trying to parse my date, the logfile is in the following format: 15 Aug 2016 00:00:03,821|INFO |snjcprddex1| This is my conf file: input { file { path =\> "I:/LOGFILES/AthenaScenario/_._" start\_position =\> beginning ignore\_older =\> 0 ``` } } ``` filter { grok { patterns\_dir =\> ["I:/LOGFILES/CONF/patterns"] match =\> ["message","%{TIMERECORD:timerecord}|"] } date { match =\> ["timerecord" , "dd MMM YYYY HH:mm:ss,SSS"] target =\> "timerecord" } } output { elasticsearch { action =\> "index" hosts =\> "localhost:9200" index =\> "athena" workers =\> 1 } stdout {codec =\> rubydebug} } And my pattern looks like this: TIMERECORD %{MONTHDAY} %{MONTH} %{YEAR} %{TIME} Logstash is somehow not parsing the date, and not showing any error message either. Please advise!! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 23, 2016, 6:01am UTC](https://discuss.elastic.co/t/date-filter-not-parsing/58644/2 "2016-08-23T06:01:56Z")
What do the resulting events look like, i.e. what the output of your stdout output? ---
**Author:** ![ash.vaidya94](https://avatars.discourse-cdn.com/v4/letter/a/aca169/32.png) [@ash.vaidya94](https://discuss.elastic.co/u/ash.vaidya94)\ **Post date:** [August 23, 2016, 6:21am UTC](https://discuss.elastic.co/t/date-filter-not-parsing/58644/3 "2016-08-23T06:21:50Z")
Hi, It shows: "message" =\> "13 Aug 2016 23:52:46,982|INFO |snjcprddex30", "@version" =\> "1", "@timestamp" =\> "2016-08-23T03:33:41.542Z", "path" =\> "I:/LOGFILES/CAPITAL.PROD.7024.snjcprddex30.l og.20160813", "host" =\> "v10153257" ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 23, 2016, 6:30am UTC](https://discuss.elastic.co/t/date-filter-not-parsing/58644/4 "2016-08-23T06:30:46Z")
Your grok expression is wrong. You don't seem so be escaping the `|` so you're either matching against TIMERECORD or an empty string. In this case I expected TIMERECORD to match anyway but for some reason it doesn't. Change your grok expression to `%{TIMERECORD:timerecord} \|`. ---
**Author:** ![ash.vaidya94](https://avatars.discourse-cdn.com/v4/letter/a/aca169/32.png) [@ash.vaidya94](https://discuss.elastic.co/u/ash.vaidya94)\ **Post date:** [August 23, 2016, 6:36am UTC](https://discuss.elastic.co/t/date-filter-not-parsing/58644/5 "2016-08-23T06:36:03Z")
Thanks. However, now i get a grokparsefailure. ``` "tags" => [ [0] "_grokparsefailure" ``` ] ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 23, 2016, 7:12am UTC](https://discuss.elastic.co/t/date-filter-not-parsing/58644/6 "2016-08-23T07:12:35Z")
Oops. Make the grok expression `^%{TIMERECORD:timerecord}\|`. Leading `^` and no space before `\|`. You should also consider using the csv filter for this kind of data. ---
**Author:** ![ash.vaidya94](https://avatars.discourse-cdn.com/v4/letter/a/aca169/32.png) [@ash.vaidya94](https://discuss.elastic.co/u/ash.vaidya94)\ **Post date:** [August 23, 2016, 8:22am UTC](https://discuss.elastic.co/t/date-filter-not-parsing/58644/7 "2016-08-23T08:22:48Z")
Thanks! Although that grok expression still didnt work, I'm using a simple csv filter now and I'm able to get what I want. Thanks again! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:42am UTC](https://discuss.elastic.co/t/date-filter-not-parsing/58644/8 "2017-07-06T04:42:07Z")