# Date Parse failuer
**URL:** https://discuss.elastic.co/t/date-parse-failuer/106164
**Category:** Logstash
**Created:** [November 2, 2017, 9:57am UTC](https://discuss.elastic.co/t/date-parse-failuer/106164 "2017-11-02T09:57:20Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@guruprasadh4](https://discuss.elastic.co/u/guruprasadh4)
#### Post date: [November 2, 2017, 9:57am UTC](https://discuss.elastic.co/t/date-parse-failuer/106164/1 "2017-11-02T09:57:20Z")
Hello All,
I am tying to create a index below are the config file and sample log. Please let me if anything wrong in my config file.
Thanks for your help!
Log :
2017-10-02 01:00:02,782 DEBUG [com.\_360commerce.foundation.util.DBConnection] SQL = SELECT VAL\_TYPE.VALTYPEID, VAL\_TYPE.VALIDATORNAME, VAL\_TYPE.CLASS, VAL\_TYPE.PACKAGE FROM PARM\_VALIDATOR, VAL\_TYPE WHERE PARM\_VALIDATOR.VALTYPEID = VAL\_TYPE.VALTYPEID AND PARM\_VALIDATOR.PARMID = ?
2017-10-02 01:00:02,782 DEBUG [com.\_360commerce.foundation.util.DBPreparedStatement] PreparedStatment variables = Count = 1
Variables = 2541,
Config File:
input {
file {
path =\> "home/gprasad/btest.log"
#type =\> "LOG"
start\_position =\> "beginning"
codec =\> multiline
{
pattern =\> "^\A%{TIMESTAMP\_ISO8601}"
negate =\> true
what =\> previous
}
}
}
filter{
mutate
{
gsub =\> ["message", "\n", ""]
gsub =\> ["message", "\r", ""]
gsub =\> ["message", "\t", ""]
}
grok {
match =\> ["message", "%{TIMESTAMP\_ISO8601:Date} \*%{LOGLEVEL:Type} [%{DATA:Application}] %{GREEDYDATA:Message}" ]
overwrite =\> ["message"]
}
date {
match =\> ["Date","[yyyy-MM-dd HH:mm:ss,zzz]"]
target =\> "Date"
}
}
output
{
#stdout{}
stdout {codec =\> rubydebug}
elasticsearch
{
hosts =\> "localhost"
index =\> "kp-log-1296-bo-index1"
}
}
Error:
{
"path" =\> "home/gprasad/btest.log",
"Type" =\> "DEBUG",
"@timestamp" =\> 2017-11-02T09:32:57.906Z,
"Message" =\> "SQL = SELECT VAL\_TYPE.VALTYPEID, VAL\_TYPE.VALIDATORNAME, VAL\_TYPE.CLASS, VAL\_TYPE.PACKAGE FROM PARM\_VALIDATOR, VAL\_TYPE WHERE PARM\_VALIDATOR.VALTYPEID = VAL\_TYPE.VALTYPEID AND PARM\_VALIDATOR.PARMID = ?",
"@version" =\> "1",
"host" =\> "[oc1008401175.ibm.com](http://oc1008401175.ibm.com)",
"message" =\> "2017-10-02 01:00:02,782 DEBUG [com.\_360commerce.foundation.util.DBConnection] SQL = SELECT VAL\_TYPE.VALTYPEID, VAL\_TYPE.VALIDATORNAME, VAL\_TYPE.CLASS, VAL\_TYPE.PACKAGE FROM PARM\_VALIDATOR, VAL\_TYPE WHERE PARM\_VALIDATOR.VALTYPEID = VAL\_TYPE.VALTYPEID AND PARM\_VALIDATOR.PARMID = ?",
"Application" =\> "com.\_360commerce.foundation.util.DBConnection",
"Date" =\> "2017-10-02 01:00:02,782",
"tags" =\> [
[0] " **\_dateparsefailure"**
]
}
---
### Author:  [@guruprasadh4](https://discuss.elastic.co/u/guruprasadh4)
#### Post date: [November 2, 2017, 10:29am UTC](https://discuss.elastic.co/t/date-parse-failuer/106164/2 "2017-11-02T10:29:22Z")
I have also used below date match format as well.
date {
match =\> ["Date","[yyyy-MM-dd HH:mm:ss,SSS]"]
target =\> "Date"
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 2, 2017, 10:43am UTC](https://discuss.elastic.co/t/date-parse-failuer/106164/3 "2017-11-02T10:43:00Z")
Why do you have square brackets in your date pattern? The `Date` field doesn't contain any square brackets.
---
### Author:  [@guruprasadh4](https://discuss.elastic.co/u/guruprasadh4)
#### Post date: [November 2, 2017, 11:23am UTC](https://discuss.elastic.co/t/date-parse-failuer/106164/4 "2017-11-02T11:23:31Z")
Thanks for your response.
I have removed the brackets and it worked.
Though we have passed this as Date, any idea why Kibana dosen't recognize this as date field. it still populate it as string.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 2, 2017, 12:10pm UTC](https://discuss.elastic.co/t/date-parse-failuer/106164/5 "2017-11-02T12:10:33Z")
When the square brackets were there ES autodetected the field as a string. Now that you've fixed your date filter the field it'll be detected as a date but existing mappings in an index will never change. Deleting the current index or waiting until the next index is created (perhaps tomorrow, depending on your configuration) will fix it.
---
### Author:  [@guruprasadh4](https://discuss.elastic.co/u/guruprasadh4)
#### Post date: [November 2, 2017, 5:59pm UTC](https://discuss.elastic.co/t/date-parse-failuer/106164/6 "2017-11-02T17:59:26Z")
Thanks a lot for your response
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 30, 2017, 5:59pm UTC](https://discuss.elastic.co/t/date-parse-failuer/106164/7 "2017-11-30T17:59:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.