# Date parse failure, cannot figure out pattern for literal characters in time stamp field
**URL:** https://discuss.elastic.co/t/date-parse-failure-cannot-figure-out-pattern-for-literal-characters-in-time-stamp-field/179412
**Category:** Logstash
**Created:** [May 2, 2019, 5:19pm UTC](https://discuss.elastic.co/t/date-parse-failure-cannot-figure-out-pattern-for-literal-characters-in-time-stamp-field/179412 "2019-05-02T17:19:12Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@tomj](https://discuss.elastic.co/u/tomj)
#### Post date: [May 2, 2019, 5:19pm UTC](https://discuss.elastic.co/t/date-parse-failure-cannot-figure-out-pattern-for-literal-characters-in-time-stamp-field/179412/1 "2019-05-02T17:19:12Z")
Using Logstash 6.4.3
I am processing Kinesis records from the Kinesis input plugin, where the 'timestamp' field looks like this:
2019-05-02T16:25:17.850884549Z
I am using the following date filter syntax (following suggestions in the docs):
`filter { date { match => ["timestamp", "yyyy-MM-dd'T'HH:mm:ss,SSS'Z'"] target => "timestamp" } }`
However, Logstash does not accept this; here is an example log message (extraneous fields omitted):
`[2019-05-02T17:06:59,934][DEBUG][logstash.pipeline] output received {"event"=>{"@version"=>"1", "fields"=>{ "@timestamp"=>2019-05-02T17:06:59.833Z, "timestamp"=>2019-05-02T17:06:57.880Z, "tags"=>["_dateparsefailure"]}}`
Edit: I should also mention that I get similar results when using the ISO8601 format literal.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 2, 2019, 6:30pm UTC](https://discuss.elastic.co/t/date-parse-failure-cannot-figure-out-pattern-for-literal-characters-in-time-stamp-field/179412/2 "2019-05-02T18:30:32Z")
> [@tomj](#):
>
> "timestamp"=\>2019-05-02T17:06:57.880Z
There are no quotes around timestamp, so that is a Logstash::TimeStamp, not a string. A date filter [cannot](https://github.com/logstash-plugins/logstash-filter-date/issues/95) parse a Logstash::Timestamp.
I am not familiar with kinesis but I know that for jdbc the input will convert datetimes in the database into Logstash::Timestamp for you, so you do not need a date filter. It may be the same for kinesis.
If adding
```
mutate { convert {"timestamp" => "string"} }
```
makes the error go away then you can just delete the date filter.
---
### Author:  [@tomj](https://discuss.elastic.co/u/tomj)
#### Post date: [May 2, 2019, 8:37pm UTC](https://discuss.elastic.co/t/date-parse-failure-cannot-figure-out-pattern-for-literal-characters-in-time-stamp-field/179412/3 "2019-05-02T20:37:30Z")
I apologize, I should have stated I was using the JSON codec with the Kinesis input for clarity.
As it turns out, I don't need either the date filter or the mutate to make it work. I inherited the configuration and just assumed that it was working all along. I had never checked the output and thus did not see the \_dateparsefailure messages until now.
Thank you, and thanks for the link to the issue. I searched Logstash issues but not the specific plugin repository issues; now I know better.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 30, 2019, 8:37pm UTC](https://discuss.elastic.co/t/date-parse-failure-cannot-figure-out-pattern-for-literal-characters-in-time-stamp-field/179412/4 "2019-05-30T20:37:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.