# Date Format Error with Full ISO Date

**URL:** <https://discuss.elastic.co/t/date-format-error-with-full-iso-date/47153>\
**Category:** Logstash\
**Created:** [April 12, 2016, 5:25pm UTC](https://discuss.elastic.co/t/date-format-error-with-full-iso-date/47153 "2016-04-12T17:25:05Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![CPoston](https://avatars.discourse-cdn.com/v4/letter/c/eb9ed0/32.png) [@CPoston](https://discuss.elastic.co/u/CPoston)\
**Post date:** [April 12, 2016, 5:25pm UTC](https://discuss.elastic.co/t/date-format-error-with-full-iso-date/47153/1 "2016-04-12T17:25:05Z")

</div>

From logstash I'm getting (removed extraneous info) :

:timestamp=\>"2016-04-12T12:14:08.428000-0500"  
:message=\>"Failed action. "  
"reason"=\>"Invalid format: "2016-04-12T12:14:04.7872034-05:00" is malformed at "-04-12T12:14:04.7872034-05:00"

I have control over the date and made the logger output an ISO date.  
In my mapping I've tried "date\_optional\_time", "date\_time" and several others and just get the aforementioned error.

What is the correct format when my document contains:  
"timestamp": "2016-04-12T12:10:42.5726374-05:00" ?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 13, 2016, 1:44am UTC](https://discuss.elastic.co/t/date-format-error-with-full-iso-date/47153/2 "2016-04-13T01:44:08Z")

</div>

> [@CPoston](#):
>
> 2016-04-12T12:10:42.5726374-05:00

The `%{TIMESTAMP_ISO8601}` grok pattern matches that, is it what you are using?

---

<div class="post-metadata">

**Author:** ![CPoston](https://avatars.discourse-cdn.com/v4/letter/c/eb9ed0/32.png) [@CPoston](https://discuss.elastic.co/u/CPoston)\
**Post date:** [April 13, 2016, 8:40pm UTC](https://discuss.elastic.co/t/date-format-error-with-full-iso-date/47153/3 "2016-04-13T20:40:38Z")

</div>

Actually I don't have that problem because it was simpler to just output the Json directly. I'm just reading with codec =\> "json". I removed the dashes from my output and got "format": "yyyyMMdd'T'HHmmss.SSSZ" to work. Is there no predefined date format that uses dashes and the offset time?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 13, 2016, 8:53pm UTC](https://discuss.elastic.co/t/date-format-error-with-full-iso-date/47153/4 "2016-04-13T20:53:02Z")

</div>

Yes, the one I mentioned;  
`TIMESTAMP_ISO8601 %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?`

---

<div class="post-metadata">

**Author:** ![CPoston](https://avatars.discourse-cdn.com/v4/letter/c/eb9ed0/32.png) [@CPoston](https://discuss.elastic.co/u/CPoston)\
**Post date:** [April 13, 2016, 9:05pm UTC](https://discuss.elastic.co/t/date-format-error-with-full-iso-date/47153/5 "2016-04-13T21:05:59Z")

</div>

Is that the Elasticsearch mapping format parameter - "TIMESTAMP\_ISO8601"?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 13, 2016, 9:07pm UTC](https://discuss.elastic.co/t/date-format-error-with-full-iso-date/47153/6 "2016-04-13T21:07:07Z")

</div>

No, this is a Logstash grok pattern.

---

<div class="post-metadata">

**Author:** ![CPoston](https://avatars.discourse-cdn.com/v4/letter/c/eb9ed0/32.png) [@CPoston](https://discuss.elastic.co/u/CPoston)\
**Post date:** [April 13, 2016, 9:09pm UTC](https://discuss.elastic.co/t/date-format-error-with-full-iso-date/47153/7 "2016-04-13T21:09:17Z")

</div>

What is the equivalent Elasticsearch constant? (Or, can you only use that format by specifying it as a format string?)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:02am UTC](https://discuss.elastic.co/t/date-format-error-with-full-iso-date/47153/8 "2017-07-06T05:02:25Z")

</div>

Closed on July 6, 2017, 5:02am UTC