# Date filter year not parsing correctly

**URL:** <https://discuss.elastic.co/t/date-filter-year-not-parsing-correctly/296883>\
**Category:** Logstash\
**Tags:** docker\
**Created:** [February 10, 2022, 5:53pm UTC](https://discuss.elastic.co/t/date-filter-year-not-parsing-correctly/296883 "2022-02-10T17:53:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![pkrishnan](https://avatars.discourse-cdn.com/v4/letter/p/13edae/32.png) [@pkrishnan](https://discuss.elastic.co/u/pkrishnan)\
**Post date:** [February 10, 2022, 5:53pm UTC](https://discuss.elastic.co/t/date-filter-year-not-parsing-correctly/296883/1 "2022-02-10T17:53:48Z")

</div>

This is my sample log line

```auto
2021-06-28 10:25:29.537695 traceID=d283c222257e0e92ba97269a5f780d81 spanID=f46645e821cb4dab A4 LG 4 Logger.cpp:250 - Configuring log file: /home/rxm/log/latest/2021-06-28-102529-log-%3N.log Archival path: /home/rxm/log/latest/

2021-06-28 10:25:29.537837 traceID=d283c222257e0e92ba97269a5f780d81 spanID=f46645e821cb4dab A4 LG 5 RxBaseNode.cpp:4475 - Log root folder: ---------- /home/rxm/log/latest/

2021-06-28 10:25:29.537861 traceID=d283c222257e0e92ba97269a5f780d81 spanID=f46645e821cb4dab A4 LG 6 RxBaseNode.cpp:450 - Configuration root folder:- /home/rxm/config/

```

And this is my Config.

```auto
filter {
  grok {
    match => {
      "message" => "%{DATESTAMP:logdate} traceID=%{WORD:traceID} spanID=%{WORD:spanID} %{GREEDYDATA:msg}"
    }
  }
  date {
    match => ["logdate" , "yyyy-MM-dd HH:mm:ss.SSSSSS"]
    target => "@timestamp"
  }
}

```

But the date filter is parsing the log date incorrectly as

2022-02-10T17:48:36.964Z

Here is the output

```auto
{
      "@version" => "1",
    "@timestamp" => 0021-06-28T04:32:01.537Z,
          "host" => "LTM-PKRISHNAN.Dlink",
          "type" => "newapiserver",
        "spanID" => "f46645e821cb4dab",
       "message" => "2021-06-28 10:25:29.537 traceID=d283c222257e0e92ba97269a5f780d81 spanID=f46645e821cb4dab A4 LG 6 RxBaseNode.cpp:450 - Configuration root folder:- /home/rxm/config/",
          "path" => "/Users/pkrishnan/Node-Apps/my-node-example/logs/newapiserver.log",
       "logdate" => "21-06-28 10:25:29.537",
           "msg" => "A4 LG 6 RxBaseNode.cpp:450 - Configuration root folder:- /home/rxm/config/",
       "traceID" => "d283c222257e0e92ba97269a5f780d81"
}

```

Why is the timestamp having a date in which I get 0021 for the year instead of 2021. This is puzzling

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 10, 2022, 6:53pm UTC](https://discuss.elastic.co/t/date-filter-year-not-parsing-correctly/296883/2 "2022-02-10T18:53:20Z")

</div>

The error is in your grok, the output of your `logdate` field is wrong, your year only have two digits.:

```auto
"logdate" => "21-06-28 10:25:29.537"

```

The `DATESTAMP` pattern is not the correct one for the date format you have, you shoud use the `TIMESTAMP_ISO8601` pattern, this will correctly parse your date.

You can check the [patterns here](https://github.com/logstash-plugins/logstash-patterns-core/blob/cd84000d4cc0acda00feb758fe7bd32b7ff60380/patterns/legacy/grok-patterns#L67-L73).

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 10, 2022, 7:18pm UTC](https://discuss.elastic.co/t/date-filter-year-not-parsing-correctly/296883/3 "2022-02-10T19:18:51Z")

</div>

> [@pkrishnan](#):
>
> `%{DATESTAMP:logdate}`

As Leandro says, this is the wrong pattern. It matches DATE\_EU or DATE\_US. In this case it will match DATE\_EU - 21-06-28, which is 21st June 1928. If you had anchored your pattern `^%{DATESTAMP:logdate}` (which is always a good thing) then the grok would have failed to match.

---

<div class="post-metadata">

**Author:** ![pkrishnan](https://avatars.discourse-cdn.com/v4/letter/p/13edae/32.png) [@pkrishnan](https://discuss.elastic.co/u/pkrishnan)\
**Post date:** [February 11, 2022, 6:26am UTC](https://discuss.elastic.co/t/date-filter-year-not-parsing-correctly/296883/4 "2022-02-11T06:26:32Z")

</div>

@leandrojmp @Badger  
Thank you. It parses fine now to this:

```auto
{
        "spanID" => "f46645e821cb4dab",
          "host" => "LTM-PKRISHNAN.Dlink",
       "traceID" => "d283c222257e0e92ba97269a5f780d81",
      "@version" => "1",
       "message" => "2021-06-28 10:25:29.537911 traceID=d283c222257e0e92ba97269a5f780d81 spanID=f46645e821cb4dab A4 LG 9 Parameter.cpp:55 - Parameter group systemConfig successfully registered.",
          "type" => "newapiserver",
           "msg" => "A4 LG 9 Parameter.cpp:55 - Parameter group systemConfig successfully registered.",
    "@timestamp" => 2021-06-28T04:55:29.537Z,
          "path" => "/Users/pkrishnan/Node-Apps/my-node-example/logs/newapiserver.log",
       "logdate" => "2021-06-28 10:25:29.537911"
}

The difference in time is due to 'timezone' and I can add that. Thank you!

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 11, 2022, 6:27am UTC](https://discuss.elastic.co/t/date-filter-year-not-parsing-correctly/296883/5 "2022-03-11T06:27:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.