# Date parsing, logstash does not take slovene locale

**URL:** <https://discuss.elastic.co/t/date-parsing-logstash-does-not-take-slovene-locale/103830>\
**Category:** Logstash\
**Created:** [October 13, 2017, 6:14am UTC](https://discuss.elastic.co/t/date-parsing-logstash-does-not-take-slovene-locale/103830 "2017-10-13T06:14:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mojster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mojster/32/21209_2.png) [@Mojster](https://discuss.elastic.co/u/Mojster)\
**Post date:** [October 13, 2017, 6:14am UTC](https://discuss.elastic.co/t/date-parsing-logstash-does-not-take-slovene-locale/103830/1 "2017-10-13T06:14:03Z")

</div>

Log entry:  
`SEARCH#Android#SLO#sikmb#BIB#sikmb#02-okt-2017 07:04:00.721#ADV##0#0#0#2#8#((šola AND luči)) NOT (DT=D) NOT RS=D and (DP=08 OR DP=XX) NOT NH=1`

filter part from pipeline:

```auto
grok {
			match => {"message" => "%{DATA:act}\#%{DATA:interface}\#%{DATA:country}\#%{DATA:acronym}\#%{DATA:typeDB}\#%{GREEDYDATA:leftovers}"}
		}
		if [act] == "CONN" {
			drop { }
		}
		ruby {
			code => "event.set('acronym', event.get('acronym').upcase)"
		}
		
		mutate{
			split => {"leftovers" => "#"}
		}
		
		if [act] == "AUTH" {
			mutate{
				add_field => {
					"date" => "%{leftovers[1]}"
					"userID" => "%{leftovers[2]}"
				}
				remove_field => [leftovers]
			}
		} else if [act] == "DISP" {
			mutate{
				add_field => {
					"date" => "%{leftovers[0]}"
					"outputType" => "%{leftovers[1]}"
					"userID" => "%{leftovers[2]}"
				}
				remove_field => [leftovers]
			}
		} else if [act] == "SEARCH" {
			mutate{
# WORKAROUND ŠUMNIKI
				add_field => {
					"url" => ""
					"date" => "%{leftovers[1]}"
					"mode" => "%{leftovers[2]}"
					"stZadetkov" => "%{leftovers[7]}"
				}
				merge => {"url" => "leftovers[9]"}
				remove_field => [leftovers]
			}
		} else if [act] == "RESR" or [act] == "PROL" or [act] == "CRES" {
			mutate{
				add_field => {
					"date" => "%{leftovers[1]}"
					"userID" => "%{leftovers[2]}"
					"serialNum" => "%{leftovers[3]}"
				}
				remove_field => [leftovers]
			}
		}
		
		date {
			locale => "sl-SI"
			match => ["date", "dd-MMM-YYYY HH:mm:ss.SSS"]
			timezone => "Europe/Ljubljana"
			target => "date"
		}
		
		mutate{
			join => {"url" => ""}
			add_field => {"inputType" => "MCOBISS"}
		}

```

My problem is, that my date `02-okt-2017 07:04:00.721` is written with using Slovenian locale  
[http://www.localeplanet.com/java/sl-SI/index.html](http://www.localeplanet.com/java/sl-SI/index.html)

I've tried in the locale setting both option `sl` and `sl_SI`.

Is there any option to process this or should I just do a `gsub` and just replace them?

---

<div class="post-metadata">

**Author:** ![Mojster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mojster/32/21209_2.png) [@Mojster](https://discuss.elastic.co/u/Mojster)\
**Post date:** [October 16, 2017, 5:50am UTC](https://discuss.elastic.co/t/date-parsing-logstash-does-not-take-slovene-locale/103830/2 "2017-10-16T05:50:52Z")

</div>

So I assume there is and will not be a fix for this.

There for I should do the dirty work. Replace mont name with `gsub` and apply the `en` locale.

---

<div class="post-metadata">

**Author:** ![Mojster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mojster/32/21209_2.png) [@Mojster](https://discuss.elastic.co/u/Mojster)\
**Post date:** [October 16, 2017, 8:39am UTC](https://discuss.elastic.co/t/date-parsing-logstash-does-not-take-slovene-locale/103830/3 "2017-10-16T08:39:17Z")

</div>

Found a fix.

Date plugin does not suport Slovenian locale (sl, sl\_SI, sl-SI) but a I found out with testing, it does support, Serbian (sr\_Latn\_RS) and the 3char months are identical.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 13, 2017, 8:39am UTC](https://discuss.elastic.co/t/date-parsing-logstash-does-not-take-slovene-locale/103830/4 "2017-11-13T08:39:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.