# Date parsing \[5.6.2\]

**URL:** <https://discuss.elastic.co/t/date-parsing-5-6-2/103368>\
**Category:** Logstash\
**Created:** [October 10, 2017, 1:08pm UTC](https://discuss.elastic.co/t/date-parsing-5-6-2/103368 "2017-10-10T13:08:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![cperriot](https://avatars.discourse-cdn.com/v4/letter/c/f475e1/32.png) [@cperriot](https://discuss.elastic.co/u/cperriot)\
**Post date:** [October 10, 2017, 1:08pm UTC](https://discuss.elastic.co/t/date-parsing-5-6-2/103368/1 "2017-10-10T13:08:46Z")

</div>

trying to parse:

```
2016-03-27 01:45:00
2016-02-20 02:15:00
2017-10-10 09:57:46

```

with the following config:

> input {  
> file {  
> sincedb\_path=\>"sincedb"  
> path =\> "/xxxxxxx/export\_test.txt"  
> start\_position =\> "beginning"  
> }  
> }
> 
> filter {  
> csv {  
> columns =\> ["start"]  
> separator =\> ","  
> }
> 
> date {  
> locale =\> "en"  
> match =\> ["start", "YYYY-MM-dd HH:mm:ss"]  
> timezone =\> "Europe/London"  
> target =\> "@timestamp"  
> }

the result is :

> {  
> "duration" =\> 2,  
> "path" =\> "/users/cperriot/logstash-5.6.2/bin/export\_test.txt",  
> "@timestamp" =\> 2017-10-10T12:55:18.085Z,  
> "@version" =\> "1",  
> "host" =\> "xxx.fr.intranet",  
> "start" =\> "2016-03-27 01:45:00",  
> "message" =\> "2016-03-27 01:45:00\r",  
> "tags" =\> [  
> [0] " **\_dateparsefailure**"  
> ]  
> }  
> {  
> "duration" =\> 3,  
> "path" =\> "/users/cperriot/logstash-5.6.2/bin/export\_test.txt",  
> "@timestamp" =\> 2016-02-20T **10:15:00.000** Z,  
> "@version" =\> "1",  
> "host" =\> "xxx.fr.intranet",  
> "start" =\> "2016-02-20 **10:15:00**",  
> "message" =\> "2016-02-20 10:15:00\r",  
> "status" =\> "16"  
> }  
> {  
> "duration" =\> 269,  
> "path" =\> "/users/cperriot/logstash-5.6.2/bin/export\_test.txt",  
> "@timestamp" =\> 2017-10-10T **08:57:46.000** Z,  
> "@version" =\> "1",  
> "host" =\> "xxx.fr.intranet",  
> "start" =\> "2017-10-10 **09:57:46**",  
> "message" =\> "2017-10-10 09:57:46\r",  
> "status" =\> "16"  
> }

There are 2 things I don't understand,

1. why the parsing failure, it seems to be linked to the timezone offset but I don't get it.

2. Why one date stays the same 10:15 whereas the other get offsetted by an hour , 9:57 to 8:57 ?

thank you

---

<div class="post-metadata">

**Author:** ![cperriot](https://avatars.discourse-cdn.com/v4/letter/c/f475e1/32.png) [@cperriot](https://discuss.elastic.co/u/cperriot)\
**Post date:** [October 10, 2017, 1:14pm UTC](https://discuss.elastic.co/t/date-parsing-5-6-2/103368/2 "2017-10-10T13:14:48Z")

</div>

OK I think I understood the second point: It is taking the date into account to know about winter/summer time.  
am i right ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 10, 2017, 6:45pm UTC](https://discuss.elastic.co/t/date-parsing-5-6-2/103368/3 "2017-10-10T18:45:43Z")

</div>

> why the parsing failure, it seems to be linked to the timezone offset but I don't get it.

I don't know, but when the date filter fails it will log a message that typically points to the part of the string it has a problem with.

> OK I think I understood the second point: It is taking the date into account to know about winter/summer time.  
> am i right ?

Yes.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 10, 2017, 7:04pm UTC](https://discuss.elastic.co/t/date-parsing-5-6-2/103368/4 "2017-10-10T19:04:00Z")

</div>

> [@cperriot](#):
>
> 2016-03-27 01:45:00

That time is not valid. BST started at 2016-03-27 01:00:00, we skipped straight to 2016-03-27 02:00:00

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 7, 2017, 7:04pm UTC](https://discuss.elastic.co/t/date-parsing-5-6-2/103368/5 "2017-11-07T19:04:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.