# Date Format is Malformed

**URL:** <https://discuss.elastic.co/t/date-format-is-malformed/150832>\
**Category:** Logstash\
**Created:** [October 3, 2018, 7:06am UTC](https://discuss.elastic.co/t/date-format-is-malformed/150832 "2018-10-03T07:06:41Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![saramali](https://avatars.discourse-cdn.com/v4/letter/s/da6949/32.png) [@saramali](https://discuss.elastic.co/u/saramali)\
**Post date:** [October 3, 2018, 7:06am UTC](https://discuss.elastic.co/t/date-format-is-malformed/150832/1 "2018-10-03T07:06:41Z")

</div>

I'm indexing logs from a server to elastic search. The timestamp of the logs is the format  
2018-09-18 11:41:01,648160559  
The grok which I am using to match it is  
%{TIMESTAMP\_ISO8601:logTimestamp}  
Since I want the logs to be indexed on the logtimestamp, i am using the date plugin as  
date  
{  
match =\> ["logTimestamp", "YYYY-MM-dd HH:mm:ss,SSSSSSSSS"]  
target =\> "logTimestamp"  
}  
But it is giving me an exception on logstash.

"error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [logTimestamp]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Invalid format: "2018-09-18 10:42:59,951000000" is malformed at " 10:42:59,951000000""}}}}}

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [October 3, 2018, 7:11am UTC](https://discuss.elastic.co/t/date-format-is-malformed/150832/2 "2018-10-03T07:11:33Z")

</div>

Elasticsearch only supports millisecond timestamps (3 decimals), so I believe you need to capture the last 6 digits of the timestamp in a separate field.

---

<div class="post-metadata">

**Author:** ![saramali](https://avatars.discourse-cdn.com/v4/letter/s/da6949/32.png) [@saramali](https://discuss.elastic.co/u/saramali)\
**Post date:** [October 3, 2018, 7:22am UTC](https://discuss.elastic.co/t/date-format-is-malformed/150832/3 "2018-10-03T07:22:50Z")

</div>

I am trying  
date  
{  
match =\> ["logTimestamp", "YYYY-MM-dd HH:mm:ss,SSS00000"]  
target =\> "logTimestamp"  
}

But it is still giving me the same error

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [October 3, 2018, 7:37am UTC](https://discuss.elastic.co/t/date-format-is-malformed/150832/4 "2018-10-03T07:37:32Z")

</div>

That does not match the pattern you have, so it is not surprising it fails. You could try adding a second grok filter to do the parsing like in this example which copies the last 6 decimals to a field named `nanos`:

```auto
grok {
  match => {
    "logTimestamp" => ["%{TIMESTAMP_ISO8601:logTimestamp}(?<nanos>\d{6})"]
  }
  overwrite =>["logTimestamp"]
}

```

---

<div class="post-metadata">

**Author:** ![saramali](https://avatars.discourse-cdn.com/v4/letter/s/da6949/32.png) [@saramali](https://discuss.elastic.co/u/saramali)\
**Post date:** [October 3, 2018, 8:49am UTC](https://discuss.elastic.co/t/date-format-is-malformed/150832/5 "2018-10-03T08:49:07Z")

</div>

> [@Christian\_Dahlqvist](#):
>
> %{TIMESTAMP\_ISO8601:logTimestamp}(?\<nanos\>\d{6})

I'm still getting the same error. Also I am pretty sure it was working before this fix. Is there something else which might be causing the problem?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 31, 2018, 8:49am UTC](https://discuss.elastic.co/t/date-format-is-malformed/150832/6 "2018-10-31T08:49:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.