# Date parse failure **URL:** https://discuss.elastic.co/t/date-parse-failure/270276 **Category:** Logstash **Created:** [April 15, 2021, 3:43pm UTC](https://discuss.elastic.co/t/date-parse-failure/270276 "2021-04-15T15:43:41Z") **Posts on this page:** 4 **Page:** 1
### Author: ![Wilfried](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wilfried/32/87137_2.png) [@Wilfried](https://discuss.elastic.co/u/Wilfried) #### Post date: [April 15, 2021, 3:43pm UTC](https://discuss.elastic.co/t/date-parse-failure/270276/1 "2021-04-15T15:43:41Z")
Hello, I struggle to understand why my date matching is failing. We trying to build a reporting application using elasticsearch for our Storage. I've that kind of data in an XML: ```xml 0 Open Object CIFS Operation Success d5c2b245-cafa-ea11-80d0-005056923059 10.244.243.161 S-1-5-21-1141645092-1946699681-618671499-71385 0 STLUC SP_P_SearchContent File 15397808166 (service);/info/library/Software UCL/Archives/BigFive/SAS-9.4.TS1M5/product_data/base __94110_cd563__ wx6 __pt__ sp0__1/pt_nls.xml 0 1 1179785 128 ``` Everything is ok with the following logstash configuration: ```auto input { beats { port => 5044 } } filter { xml { source => "message" xpath => [ "/Event/System/EventID/text()", "EventID", "/Event/System/EventName/text()", "EventName", "/Event/System/Source/text()", "Source", "/Event/System/Result/text()", "Result", "/Event/System/TimeCreated/@SystemTime", "SystemTime", "/Event/System/Computer/text()", "Computer", "/Event/EventData/ClientIP/text()", "ClientIP", "/Event/EventData/UnixID/text()", "UnixID", "/Event/EventData/WindowsSID/text()", "WindowsSID", "/Event/EventData/UserIsLocal/text()", "UserIsLocal", "/Event/EventData/DomainName/text()", "DomainName", "/Event/EventData/UserName/text()", "UserName", "/Event/EventData/ObjectType/text()", "ObjectType", "/Event/EventData/HandleID/text()", "HandleID", "/Event/EventData/ObjectName/text()", "ObjectName", "/Event/EventData/ReadOffSet/text()", "ReadOffset", "/Event/EventData/ReadCount/text()", "ReadCount", "/Event/EventData/UserACE/text()", "UserACE", "/Event/EventData/UserACEMask/text()", "UserACEMask", "/Event/EventData/DesiredAcces/text()", "DesiredAcces", "/Event/EventData/Attributes/text()", "Attributes", "/Event/EventData/WriteOffSet/text()", "WriteOffset", "/Event/EventData/WriteCount/text()", "WriteCount", "/Event/EventData/InformationSet/text()", "InformationSet", "/Event/EventData/NewDirHandle/text()", "NewDirHandle", "/Event/EventData/NewPath/text()", "NewPath", "/Event/EventData/ACECount/text()", "ACECount", "/Event/EventData/FailureReason/text()", "FailureReason" ] store_xml => true target => "doc" } date { match => ["SystemTime", "yyyy-MM-dd HH:mm:ss"] timezone => "Europe/Brussels" target => "@timestamp" } } ``` The SystemTime field is correctly populated with the date value but the document on elasticsearch have the tags `_dateparsefailure` and the timestamp is not replaced. Is someone have any clue ? It really seems to me that I'm right in my logstash conf. ---
### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb) #### Post date: [April 16, 2021, 3:43am UTC](https://discuss.elastic.co/t/date-parse-failure/270276/2 "2021-04-16T03:43:24Z")
Hi @Wilfried Yup so first in logstash when debugging you should always try debug output in the output section `stdout { codec => rubydebug }` If you did you would see the output is put into arrays example ``` "System" => [ [0] { "TimeCreated" => [ [0] { "SystemTime" => "2020-09-23 00:09:20" } ], ``` So what you need to is assuming you want to is not put all the data into arrays. There is a [force\_array](https://www.elastic.co/guide/en/logstash/current/plugins-filters-xml.html#plugins-filters-xml-force_array) parameter ``` filter { xml { source => "message" force_array => false ... date { match => ["SystemTime", "yyyy-MM-dd HH:mm:ss"] timezone => "Europe/Brussels" target => "@timestamp" } ``` And I think you see what you want... ``` "ClientIP" => "10.244.243.161", "UserACE" => "0", "UserName" => "SP_P_SearchContent", "ObjectType" => "File", "UserACEMask" => "1", "@timestamp" => 2020-09-22T22:09:20.000Z, "ObjectName" => "(service);/info/library/Software UCL/Archives/BigFive/SAS-9.4.TS1M5/product_data/base __94110_cd563__ wx6 __pt__ sp0__1/pt_nls.xml", "Result" => "Operation Success", "EventName" => "Open Objet", "UserIsLocal" => "0", "HandleID" => "15397808166", ``` Also You may want to consider whether want to set `store_xml` to false otherwise it creates a lot of redundant data. ```auto store_xml => false ``` ---
### Author: ![Wilfried](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wilfried/32/87137_2.png) [@Wilfried](https://discuss.elastic.co/u/Wilfried) #### Post date: [April 16, 2021, 1:42pm UTC](https://discuss.elastic.co/t/date-parse-failure/270276/3 "2021-04-16T13:42:12Z")
It works ! Thanks for the clarification. With theses modifications the filter and date works as intended. ```auto filter { xml { source => "message" force_array => false xpath => [ "/Event/System/EventID/text()", "EventID", "/Event/System/EventName/text()", "EventName", "/Event/System/Source/text()", "Source", "/Event/System/Result/text()", "Result", "/Event/System/TimeCreated/@SystemTime", "SystemTime", "/Event/System/Computer/text()", "Computer", "/Event/EventData/ClientIP/text()", "ClientIP", "/Event/EventData/UnixID/text()", "UnixID", "/Event/EventData/WindowsSID/text()", "WindowsSID", "/Event/EventData/UserIsLocal/text()", "UserIsLocal", "/Event/EventData/DomainName/text()", "DomainName", "/Event/EventData/UserName/text()", "UserName", "/Event/EventData/ObjectType/text()", "ObjectType", "/Event/EventData/HandleID/text()", "HandleID", "/Event/EventData/ObjectName/text()", "ObjectName", "/Event/EventData/ReadOffSet/text()", "ReadOffset", "/Event/EventData/ReadCount/text()", "ReadCount", "/Event/EventData/UserACE/text()", "UserACE", "/Event/EventData/UserACEMask/text()", "UserACEMask", "/Event/EventData/DesiredAcces/text()", "DesiredAcces", "/Event/EventData/Attributes/text()", "Attributes", "/Event/EventData/WriteOffSet/text()", "WriteOffset", "/Event/EventData/WriteCount/text()", "WriteCount", "/Event/EventData/InformationSet/text()", "InformationSet", "/Event/EventData/NewDirHandle/text()", "NewDirHandle", "/Event/EventData/NewPath/text()", "NewPath", "/Event/EventData/ACECount/text()", "ACECount", "/Event/EventData/FailureReason/text()", "FailureReason" ] store_xml => false target => "doc" } date { match => ["SystemTime", "yyyy-MM-dd HH:mm:ss"] timezone => "Europe/Brussels" target => "@timestamp" } } ``` ---
### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system) #### Post date: [May 14, 2021, 1:42pm UTC](https://discuss.elastic.co/t/date-parse-failure/270276/4 "2021-05-14T13:42:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.