# Date parsing issue for ISO8601 in storing first line

**URL:** <https://discuss.elastic.co/t/date-parsing-issue-for-iso8601-in-storing-first-line/360608>\
**Category:** Logstash\
**Created:** [May 31, 2024, 9:09am UTC](https://discuss.elastic.co/t/date-parsing-issue-for-iso8601-in-storing-first-line/360608 "2024-05-31T09:09:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![prashant1](https://avatars.discourse-cdn.com/v4/letter/p/bc8723/32.png) [@prashant1](https://discuss.elastic.co/u/prashant1)\
**Post date:** [May 31, 2024, 9:09am UTC](https://discuss.elastic.co/t/date-parsing-issue-for-iso8601-in-storing-first-line/360608/1 "2024-05-31T09:09:15Z")

</div>

We are reading the data from csv file and storing it on elasticsearch. Below is the filter used for date

```auto
date {
    match => ["extractTimestamp", "ISO8601"]
    target => "extractTimestamp"
    tag_on_failure => ["extractDatetimefailure"]
}

```

extractTimestamp- 2024-05-27T18:46:49.089Z  
Please refer the file data

```auto
2024-05-27T18:46:49.089Z TEST1 PL 83 202405120150003821A1 2024-05-14T07:21:00.000Z 399.00 Closed TEST 50 12345678
2024-05-27T18:46:49.089Z TEST2 PL 83 202405120150003821A1 2024-05-14T07:21:00.000Z 399.00 Closed TEST1 50 12345678

```

The issue is when first line inserts it throws dateparse exception. For rest of the logs there is no exception.  
On daily basis for the first line log it is failing with dateparse.

Could you please help us in understanding the issue?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [May 31, 2024, 9:58am UTC](https://discuss.elastic.co/t/date-parsing-issue-for-iso8601-in-storing-first-line/360608/2 "2024-05-31T09:58:21Z")

</div>

Data looks OK. It's not clear where is the issue.

Can you check what is an error by handling output:

```auto
output {
  if "extractDatetimefailure" in [tags] {
    file { path => "/path/error_%{+YYYY-MM-dd}.txt" }
   # you can use index as well instead of file
  }
... 
}

```

Do you have any specific settings in csv plugin/codec like skip\_header or similar?

---

<div class="post-metadata">

**Author:** ![prashant1](https://avatars.discourse-cdn.com/v4/letter/p/bc8723/32.png) [@prashant1](https://discuss.elastic.co/u/prashant1)\
**Post date:** [May 31, 2024, 10:12am UTC](https://discuss.elastic.co/t/date-parsing-issue-for-iso8601-in-storing-first-line/360608/3 "2024-05-31T10:12:38Z")

</div>

thanks @Rios for the quick response.  
Will check and update.