# Date pattern wrong, grok parse failure

**URL:** <https://discuss.elastic.co/t/date-pattern-wrong-grok-parse-failure/74622>\
**Category:** Logstash\
**Created:** [February 10, 2017, 9:04am UTC](https://discuss.elastic.co/t/date-pattern-wrong-grok-parse-failure/74622 "2017-02-10T09:04:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Post date:** [February 10, 2017, 9:04am UTC](https://discuss.elastic.co/t/date-pattern-wrong-grok-parse-failure/74622/1 "2017-02-10T09:04:12Z")

</div>

Hi,

I have a log shipped through Filebeat with date like `Fri Nov 11 11:00:39 GMT 2016`. I would like to add this to a timestamp variable in Logstash using match filter like;

```
(?<timestamp>%{DAY} %{MONTH} %{MONTHDAY} %{HOUR}:?%{MINUTE}(?::?%{SECOND}) %{Z} 20%{YEAR})

```

This is giving me a `_grokparsefailure`. If I give `GMT` instead of `%{Z}`, it is working fine. How can I fix this?

Thanks in advance..

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 10, 2017, 12:08pm UTC](https://discuss.elastic.co/t/date-pattern-wrong-grok-parse-failure/74622/2 "2017-02-10T12:08:47Z")

</div>

The standard set of grok patterns doesn't include a "Z" pattern so it's not surprising it doesn't work. Is the timezone always GMT? That kind of timezone name is problematic because they're ambiguous so the date filter can't parse them. It would be easier if you either used a single timezone or if the timezone was specified with an explicit UTC offset.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 10, 2017, 12:08pm UTC](https://discuss.elastic.co/t/date-pattern-wrong-grok-parse-failure/74622/3 "2017-03-10T12:08:52Z")

</div>

Closed on March 10, 2017, 12:08pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.