# Date Parsing ignored in Logstash--\>@timestamp not updated

**URL:** <https://discuss.elastic.co/t/date-parsing-ignored-in-logstash-timestamp-not-updated/65826>\
**Category:** Logstash\
**Created:** [November 11, 2016, 3:33pm UTC](https://discuss.elastic.co/t/date-parsing-ignored-in-logstash-timestamp-not-updated/65826 "2016-11-11T15:33:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![momoXD](https://avatars.discourse-cdn.com/v4/letter/m/f6c823/32.png) [@momoXD](https://discuss.elastic.co/u/momoXD)\
**Post date:** [November 11, 2016, 3:33pm UTC](https://discuss.elastic.co/t/date-parsing-ignored-in-logstash-timestamp-not-updated/65826/1 "2016-11-11T15:33:02Z")

</div>

I've got logs includiong timesamps like: **"04/Nov/2016:00:00:16 +0100"** I parse them via grok in a variable I call "apacheTime" and I want to use the date filter to parse them and overwrite "@timestamp".  
So I included:

> date {  
> locale =\> "en"  
> match =\> ["apacheTimestamp", "dd/MMM/YYYY:HH:mm:ss Z"]  
> }  
> as an additional filter.  
> However the @timestamp variable remains unchanged (and there is no error or anything).

Minimal example below:

Input:

> 99.99.99.99 - - [04/Nov/2016:07:00:00 +0100]

logstash .conf:

> # The # character at the beginning of a line indicates a comment. Use
> 
> # comments to describe your configuration.
> 
> input {  
> beats {  
> port =\> "5043"  
> }  
> }
> 
> # The filter part of this file is commented out to indicate that it is
> 
> # optional.
> 
> filter {  
> grok {  
> patterns\_dir =\> ["./patterns"]  
> match =\> { "message" =\> "%{IP:clientIp} %{APACHEDATA:remoteLogname} %{APACHEUSER:remoteUser} [%{HTTPDATE:apacheTimestamp}]"}  
> }  
> date {  
> locale =\> "en"  
> match =\> ["apacheTimestamp", "dd/MMM/YYYY:HH:mm:ss Z"]  
> }
> 
> }  
> output {  
> stdout {codec =\> rubydebug}

> }

Pattern file:

> APACHEREPSIZE %{NUMBER}|-  
> APACHEHOSTNAME %{HOSTNAME}|-  
> APACHEIP %{IP}|-  
> APACHEURI %{URI}|-  
> APACHEDATA %{DATA}|-  
> APACHESTRING %{QUOTEDSTRING}|-  
> APACHEUSER %{USER}|-  
> TIMEZONE [+|-]%{INT}  
> HTTPDATE %{MONTHDAY}/%{MONTH}/%{YEAR}:?%{HOUR}:?%{MINUTE}(:%{SECOND}) ?%{TIMEZONE}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 14, 2016, 6:48am UTC](https://discuss.elastic.co/t/date-parsing-ignored-in-logstash-timestamp-not-updated/65826/2 "2016-11-14T06:48:06Z")

</div>

Please show an example event as produced by your `stdout {codec => rubydebug}` output.

---

<div class="post-metadata">

**Author:** ![momoXD](https://avatars.discourse-cdn.com/v4/letter/m/f6c823/32.png) [@momoXD](https://discuss.elastic.co/u/momoXD)\
**Post date:** [November 14, 2016, 10:03am UTC](https://discuss.elastic.co/t/date-parsing-ignored-in-logstash-timestamp-not-updated/65826/3 "2016-11-14T10:03:38Z")

</div>

Problem magically solved itself (see screenshot for result).  
I didn't change anything on the configuration since Friday. However a new JDK was installed on the testmaschine, maybe that solved the problem or the testmaschine just needed some rest at the weekend 😃

 ![](https://us1.discourse-cdn.com/elastic/original/2X/8/89425ae8998d77d08f431a971bd89ac216064b5b.PNG)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 12, 2016, 10:03am UTC](https://discuss.elastic.co/t/date-parsing-ignored-in-logstash-timestamp-not-updated/65826/4 "2016-12-12T10:03:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.