### Author:  [@Djelouah\_Laala](https://discuss.elastic.co/u/Djelouah_Laala)
#### Post date: [May 2, 2017, 1:19pm UTC](https://discuss.elastic.co/t/date-parse-error/84269/1 "2017-05-02T13:19:35Z")
Hi guys,
i'm trying to parse a date like this one : 2017-04-29 00:00:00 +0200
I'm using this date filter : `filter { date { match => ["txechecczhier_date", "yyyy-MM-dd HH:mm:ss Z"] } }`
I'm getting a result like this `{"txechecczhier_date":"2017-04-29 00:00:00 +0200","@version":"1","@timestamp":"2017-05-02T13:08:01.755Z","Name":"echec_cz_hier","tags":["_dateparsefailure"]}`
What's wrong? could you say me why i'm getting a dateparsefailure please?
Thank you
---
### Author:  [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)
#### Post date: [May 2, 2017, 1:30pm UTC](https://discuss.elastic.co/t/date-parse-error/84269/2 "2017-05-02T13:30:00Z")
Use YYYY for year instead of yyyy.
And maybe Z option does not work well. Put +0200 instead if you've only got one timezone.
But can you try this? (not sure about the space between time and timezone, but worth testing)
```auto
date {
match => ["txechecczhier_date", "ISO8601"]
}
```
---
### Author:  [@Djelouah\_Laala](https://discuss.elastic.co/u/Djelouah_Laala)
#### Post date: [May 2, 2017, 1:40pm UTC](https://discuss.elastic.co/t/date-parse-error/84269/3 "2017-05-02T13:40:27Z")
Hi Nico,
I tried it but i'm always getting this error message (in all cases) :
`Failed parsing date from field {:field=>"txechecczhier_date, : value=>#"cannot convert instance of class org.jruby.RubyoObject to class java.lang.string", :config_parsers=>"ISO8601", : config_locale=>"default=fr_FR", :level=>:warn}`
---
### Author:  [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)
#### Post date: [May 2, 2017, 1:46pm UTC](https://discuss.elastic.co/t/date-parse-error/84269/4 "2017-05-02T13:46:57Z")
Ok, then, there's something that I have done when I had kinda the same problem.
I used to have a timestamp like this:
`20170420 10:02:04,876 +0000`
So I created the following pattern:
`F_TIMESTAMP %{YEAR:year}%{MONTHNUM:month}%{MONTHDAY:monthday}\s*%{TIME:time}\s*%{ISO8601_TIMEZONE:timezone}`
So now, I don't have a timestamp in my document (which would be txechecczhier\_date for you)
Then, I do:
```auto
add_field => {
"timestamp" => "%{year}-%{month}-%{monthday}T%{time}%{timezone}"
}
```
And now I can use
```auto
date {
match => ["timestamp", "ISO8601"]
target => "@timestamp"
}
```
Clunky as hell, but it works
---
### Author:  [@Djelouah\_Laala](https://discuss.elastic.co/u/Djelouah_Laala)
#### Post date: [May 2, 2017, 1:50pm UTC](https://discuss.elastic.co/t/date-parse-error/84269/5 "2017-05-02T13:50:42Z")
So if i understand, i have to create a grok pattern too? bacause in my case i need the txechecczhier\_date and also the @timestamp which have differents values
---
### Author:  [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)
#### Post date: [May 2, 2017, 1:54pm UTC](https://discuss.elastic.co/t/date-parse-error/84269/6 "2017-05-02T13:54:05Z")
No, you don't have to. It's just something that I have done to kinda avoid this date problem.
(You can keep both your timestamp, in my case I override it because I don't need it)
The problem might come from the timezone. Try to send some dummy log to see if the part without the timezone is correctly matched
All patterns are defined here: [http://joda-time.sourceforge.net/apidocs/org/joda/time/format/DateTimeFormat.html](http://joda-time.sourceforge.net/apidocs/org/joda/time/format/DateTimeFormat.html)
---
### Author:  [@Djelouah\_Laala](https://discuss.elastic.co/u/Djelouah_Laala)
#### Post date: [May 2, 2017, 2:03pm UTC](https://discuss.elastic.co/t/date-parse-error/84269/7 "2017-05-02T14:03:35Z")
I used stdin and send some data and i have this result :
`{"message":"2017-04-29 00:00:00 +0200\r","@version":"1","@timestamp":"2017-05-02T14:01:02.506Z","host":"HOME"} {"message":"2017-03-29 15:00:00 +0500\r","@version":"1","@timestamp":"2017-05-02T14:02:21.641Z","host":"HOME"} {"message":"2017-03-29 15:01:00 +0500\r","@version":"1","@timestamp":"2017-05-02T14:02:31.201Z","host":"HOME"}`
And i'm getting this with the filter :
`{"message":"2017-04-29 00:00:00\r","@version":"1","@timestamp":"2017-05-02T14:06:36.545Z","HOME":"CD001603","tags":["_dateparsefailure"]} {"message":"2017-04-29 00:00:00\r","@version":"1","@timestamp":"2017-05-02T14:06:51.880Z","host":"HOME","tags":["_dateparsefailure"]}`
---
### Author:  [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)
#### Post date: [May 2, 2017, 2:08pm UTC](https://discuss.elastic.co/t/date-parse-error/84269/8 "2017-05-02T14:08:52Z")
Try to just send `2017-04-29 00:00:00` (no timezone) and modify your date filter to match this date, and see what happens
Btw, use
```auto
stdout {
codec => rubydebug {}
}
```
to see if there is any relevant stacktrace
---
### Author:  [@Djelouah\_Laala](https://discuss.elastic.co/u/Djelouah_Laala)
#### Post date: [May 2, 2017, 2:16pm UTC](https://discuss.elastic.co/t/date-parse-error/84269/9 "2017-05-02T14:16:04Z")
I'm getting this error without timezone.
My code is like this :
---
### Author:  [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)
#### Post date: [May 2, 2017, 2:20pm UTC](https://discuss.elastic.co/t/date-parse-error/84269/10 "2017-05-02T14:20:01Z")
there's a problem with the \r (probably waiting a \n instead).
Maybe use a file input with this line and a carriage return
```auto
input{
file{
path => "C:/dummy.log"
start_position => "beginning"
sincedb_path => "NUL"
}
}
```
---
### Author:  [@Djelouah\_Laala](https://discuss.elastic.co/u/Djelouah_Laala)
#### Post date: [May 2, 2017, 2:27pm UTC](https://discuss.elastic.co/t/date-parse-error/84269/11 "2017-05-02T14:27:02Z")
> [@Nico-DF](#):
>
> 2017-04-29 00:00:00
I resolved the problem of line breaks think to this filter
`mutate { strip => "message" }`
I'll try to use this with my first code
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 3, 2017, 5:44am UTC](https://discuss.elastic.co/t/date-parse-error/84269/12 "2017-05-03T05:44:04Z")
> cannot convert instance of class org.jruby.RubyoObject to class java.lang.string
This indicates that the problem is that the field you're trying to parse already is a timestamp. I recently reported this in an issue ([Date filter fails to parse timestamps · Issue #95 · logstash-plugins/logstash-filter-date · GitHub](https://github.com/logstash-plugins/logstash-filter-date/issues/95)). As a workaround you can use the mutate filter's convert option to turn the field into a string.
---
### Author:  [@Djelouah\_Laala](https://discuss.elastic.co/u/Djelouah_Laala)
#### Post date: [May 3, 2017, 12:18pm UTC](https://discuss.elastic.co/t/date-parse-error/84269/13 "2017-05-03T12:18:50Z")
Thank you Magnus, I found my hapiness with the mutate filter
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 31, 2017, 12:31pm UTC](https://discuss.elastic.co/t/date-parse-error/84269/14 "2017-05-31T12:31:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.