# Date parsing issue for getting timestamp

**URL:** https://discuss.elastic.co/t/date-parsing-issue-for-getting-timestamp/82816
**Category:** Logstash
**Created:** [April 19, 2017, 5:10am UTC](https://discuss.elastic.co/t/date-parsing-issue-for-getting-timestamp/82816 "2017-04-19T05:10:47Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![san\_maj](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@san\_maj](https://discuss.elastic.co/u/san_maj)
#### Post date: [April 19, 2017, 5:10am UTC](https://discuss.elastic.co/t/date-parsing-issue-for-getting-timestamp/82816/1 "2017-04-19T05:10:47Z")

</div>

I am aware that there have been many questions asked around this and this probably could be a repeat of sorts. But have to request someone guiding me on this. My log file looks like this -

```
<event timestamp="2017-04-17T14:00:59.9604138-04:00" .......> my log message <event>

```

I tried grok filter and xml filter as below -

filter {  
grok {  
match =\> ["message", "%{TIMESTAMP\_ISO8601:timestamp}"]  
}

xml {  
source =\> "message"  
target =\> "logmessage"  
xpath =\> ["event/@timestamp","logmessage"]  
}

date {  
match =\> ["logmessage.timestamp", "yyyy-MM-dd HH:mm:ss.SSSZ"]  
}  
}

The xml just takes every attribute of the xml node "event" and populates into the "logmessage" field as - logmessage.timestamp etc.

As for the first match its comparing to the ISO8601 format but not able to get in elasticsearch db as date. I basically need that time in the given format from my log to go in as a date and not string so that I can set index pattern based off of this value. Or update the @timestamp default value to log time of my file

Can you please highlight what am I doing wrong here and what's the resolve? Sorry if this is a repeat question but I couldn't find someone having this field format for timestamp.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 19, 2017, 10:53am UTC](https://discuss.elastic.co/t/date-parsing-issue-for-getting-timestamp/82816/2 "2017-04-19T10:53:03Z")

</div>

> target =\> "logmessage"  
> xpath =\> ["event/@timestamp","logmessage"]

You're asking Logstash to store the whole XML document in the `logmessage` field but _also_ store the `timestamp` attribute in the `logmessage` field. Pick one of them, not both. If you remove the `target` option remember to disable `store_xml`.

> The xml just takes every attribute of the xml node "event" and populates into the "logmessage" field as - logmessage.timestamp etc.

Yes, and you need to reference the field with the syntax `[logmessage][timestamp`.

> match =\> ["logmessage.timestamp", "yyyy-MM-dd HH:mm:ss.SSSZ"]

Since your timestamps have microsecond precision I suspect you'll have to use the pattern "yyyy-MM-dd HH:mm:ss.SSSSSSZ" instead. Or "ISO8601".

---

<div class="post-metadata">

### Author: ![san\_maj](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@san\_maj](https://discuss.elastic.co/u/san_maj)
#### Post date: [April 19, 2017, 12:44pm UTC](https://discuss.elastic.co/t/date-parsing-issue-for-getting-timestamp/82816/3 "2017-04-19T12:44:41Z")

</div>

Thanks @magnusbaeck! I get a "\_dateparsefailure" while using eitherof the patterns you shared. So now my logstash conf looks like -

filter {  
grok {  
match =\> ["message", "%{TIMESTAMP\_ISO8601:timestamp}"]  
}

xml {  
source =\> "message"  
store\_xml =\> false  
xpath =\> ["event/@timestamp","logmessage"]  
}

date {  
match =\> ["logmessage", "yyyy-MM-dd HH:mm:ss.SSSSSSZ"]  
}

}

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 20, 2017, 5:01am UTC](https://discuss.elastic.co/t/date-parsing-issue-for-getting-timestamp/82816/4 "2017-04-20T05:01:02Z")

</div>

When you get a `_dateparsefailure` tag you can find more information about the failure in the Logstash log.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 18, 2017, 5:06am UTC](https://discuss.elastic.co/t/date-parsing-issue-for-getting-timestamp/82816/5 "2017-05-18T05:06:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.