# Date filter usage to avoid \_dateparsefailure

**URL:** <https://discuss.elastic.co/t/date-filter-usage-to-avoid--dateparsefailure/52831>\
**Category:** Logstash\
**Created:** [June 15, 2016, 7:56am UTC](https://discuss.elastic.co/t/date-filter-usage-to-avoid--dateparsefailure/52831 "2016-06-15T07:56:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sumeshms](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sumeshms/32/10409_2.png) [@sumeshms](https://discuss.elastic.co/u/sumeshms)\
**Post date:** [June 15, 2016, 7:56am UTC](https://discuss.elastic.co/t/date-filter-usage-to-avoid--dateparsefailure/52831/1 "2016-06-15T07:56:44Z")

</div>

Hello

I am getting \_dateparsefailure

# This is my actual log:

# "message": "protocol=6, source-ip=192.168.1.81, source-port=64737, destination-ip=1.1.1.1, destination-port=443, time=2016/06/15 10:34:17, interzone-trust(public)-dmz(public) outbound, policy=0. "

This is the content of logstash.log

# {:timestamp=\>"2016-06-15T10:42:11.903000+0300", :message=\>"Failed parsing date from field", :field=\>"timestamp", :value=\>"2016-06-15 07:39:54", :exception=\>"Invalid format: "2016-06-15 07:39:54" is too short", :config\_parsers=\>"MMM d HH:mm:ss,MMM dd HH:mm:ss,ISO8601", :config\_locale=\>"default=en\_US", :level=\>:warn}

And this is my filter conf

grok  
{  
match =\> ["message","(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME})"]  
}  
date {  
match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss"]  
target =\> "timestamp"  
}

I wonder why the "config\_parsers=\>" shows "MMM d HH:mm:ss,MMM dd HH:mm:ss,ISO8601" in the logstash.log even after restarting logstash which supposed to be "yyyy-MM-dd HH:mm:ss"?

What would be the correct parser to resolve the error?

Regards  
Sumesh MS

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 15, 2016, 8:07am UTC](https://discuss.elastic.co/t/date-filter-usage-to-avoid--dateparsefailure/52831/2 "2016-06-15T08:07:46Z")

</div>

> I wonder why the "config\_parsers=\>" shows "MMM d HH:mm:ss,MMM dd HH:mm:ss,ISO8601" in the logstash.log even after restarting logstash which supposed to be "yyyy-MM-dd HH:mm:ss"?

Did you ever have the pattern set to "MMM d HH:mm:ss,MMM dd HH:mm:ss,ISO8601"?

---

<div class="post-metadata">

**Author:** ![sumeshms](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sumeshms/32/10409_2.png) [@sumeshms](https://discuss.elastic.co/u/sumeshms)\
**Post date:** [June 15, 2016, 8:10am UTC](https://discuss.elastic.co/t/date-filter-usage-to-avoid--dateparsefailure/52831/3 "2016-06-15T08:10:31Z")

</div>

No, I haven't set the pattern anywhere in logstash config files . In fact am having fresh filter config .

Regards  
Sumesh

---

<div class="post-metadata">

**Author:** ![sumeshms](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sumeshms/32/10409_2.png) [@sumeshms](https://discuss.elastic.co/u/sumeshms)\
**Post date:** [June 15, 2016, 10:03am UTC](https://discuss.elastic.co/t/date-filter-usage-to-avoid--dateparsefailure/52831/4 "2016-06-15T10:03:48Z")

</div>

Any other options to find out?

Regards  
Sumesh

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:52am UTC](https://discuss.elastic.co/t/date-filter-usage-to-avoid--dateparsefailure/52831/5 "2017-07-06T04:52:44Z")

</div>