# \_dateparseerror **URL:** \ **Category:** Logstash\ **Created:** [August 12, 2019, 4:22pm UTC](https://discuss.elastic.co/t/dateparseerror/194889 "2019-08-12T16:22:19Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Sajal](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@Sajal](https://discuss.elastic.co/u/Sajal)\ **Post date:** [August 12, 2019, 4:22pm UTC](https://discuss.elastic.co/t/dateparseerror/194889/1 "2019-08-12T16:22:19Z")
How to parse 2019-08-12T03:09:13.142635Z ? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 12, 2019, 6:00pm UTC](https://discuss.elastic.co/t/dateparseerror/194889/2 "2019-08-12T18:00:29Z")
> [@Sajal](#): > > 2019-08-12T03:09:13.142635Z Sample Data ``` 2019-07-12T03:09:13.142635Z, an interesting message1 2019-07-13T03:09:13.333765Z, an interesting message2 2019-07-14T03:09:13.444987Z, an interesting message3 2019-07-15T03:09:13.555Z, an interesting message4 ``` Sample Conf ``` filter{ # Parse the log line grok { match => { "message" => "%{GREEDYDATA:timestamp_with_usec}, %{GREEDYDATA:message_detail}" } } # Parse Date date { match => ["timestamp_with_usec", "YYYY-MM-dd'T'HH:mm:ss.SSSSSSZ"] } # Copy into @timestamp field if you want mutate { copy => { "timestamp_with_usec" => "timestamp" } } ``` } Sample Results ``` { "timestamp" => "2019-07-12T03:09:13.142635Z", "message" => "2019-07-12T03:09:13.142635Z, an interesting message1", "timestamp_with_usec" => "2019-07-12T03:09:13.142635Z", "@timestamp" => 2019-07-12T03:09:13.142Z, "path" => "/Users/sbrown/workspace/sample-data/timestamps/timestamp.log", "host" => "ceres", "@version" => "1", "message_detail" => "an interesting message1" } { "timestamp" => "2019-07-13T03:09:13.333765Z", "message" => "2019-07-13T03:09:13.333765Z, an interesting message2", "timestamp_with_usec" => "2019-07-13T03:09:13.333765Z", "@timestamp" => 2019-07-13T03:09:13.333Z, "path" => "/Users/sbrown/workspace/sample-data/timestamps/timestamp.log", "host" => "ceres", "@version" => "1", "message_detail" => "an interesting message2" } { "timestamp" => "2019-07-14T03:09:13.444987Z", "message" => "2019-07-14T03:09:13.444987Z, an interesting message3", "timestamp_with_usec" => "2019-07-14T03:09:13.444987Z", "@timestamp" => 2019-07-14T03:09:13.444Z, "path" => "/Users/sbrown/workspace/sample-data/timestamps/timestamp.log", "host" => "ceres", "@version" => "1", "message_detail" => "an interesting message3" } { "timestamp" => "2019-07-15T03:09:13.555Z", "message" => "2019-07-15T03:09:13.555Z, an interesting message4", "timestamp_with_usec" => "2019-07-15T03:09:13.555Z", "@timestamp" => 2019-07-15T03:09:13.555Z, "path" => "/Users/sbrown/workspace/sample-data/timestamps/timestamp.log", "host" => "ceres", "@version" => "1", "message_detail" => "an interesting message4" } ``` ---
**Author:** ![Sajal](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@Sajal](https://discuss.elastic.co/u/Sajal)\ **Post date:** [August 12, 2019, 6:19pm UTC](https://discuss.elastic.co/t/dateparseerror/194889/3 "2019-08-12T18:19:35Z")
Hi Stephen , I didn't got your solution.I am using below config and getting \_dateparseerror. filter { mutate { convert { "timestamp" =\> "string" } } date { match =\> ["timestamp", "yyyy-MM-dd'T'HH:mm:ss'.'SSS'Z'"] timezone =\> "UCT" target =\> "timestamp" } } ---
**Author:** ![Sajal](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@Sajal](https://discuss.elastic.co/u/Sajal)\ **Post date:** [August 12, 2019, 6:22pm UTC](https://discuss.elastic.co/t/dateparseerror/194889/4 "2019-08-12T18:22:04Z")
I want date in this format : Aug 12, 2019 @ 23:04:53.167 . Just take same example and send logstash configuration. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 12, 2019, 6:54pm UTC](https://discuss.elastic.co/t/dateparseerror/194889/5 "2019-08-12T18:54:20Z")
Try this.. ``` date { match => ["timestamp_with_usec", "YYYY-MM-dd'T'HH:mm:ss.SSSSSSZ"] target => "timestamp" } ``` > [@Sajal](#): > > I want date in this format : Aug 12, 2019 @ 23:04:53.167 . Just take same example and send logstash configuration. Apologies but I am unclear what you want. Is `Aug 12, 2019 @ 23:04:53.167` that what you want to see in the Kibana UI.? .. where do you want to see that format or is that the input / log format? All dates are stored internally in Elasticsearch they are converted to UTC (if the time-zone is specified) and stored as a long number representing milliseconds-since-the-epoch. > **[Date field type | Elasticsearch Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/date.html)** Date formats are used when converting into Elasticsearch or formatting output. I am unclear what you are looking for please give an example log input line and perhaps I can help... If you get this date into Elasticsearch correctly this format `Aug 12, 2019 @ 23:04:53.167` will show up in Kibana automatically Please surround all logs and confs with the using the format button above `` ---
**Author:** ![Sajal](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@Sajal](https://discuss.elastic.co/u/Sajal)\ **Post date:** [August 13, 2019, 3:06am UTC](https://discuss.elastic.co/t/dateparseerror/194889/6 "2019-08-13T03:06:48Z")
Hi Stephen , Please find below details : Input file : 2019-08-12T03:10:01.087Z Logstash configuration : input { file { path =\> "/opt/date.log" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } filter { mutate { convert =\> { "timestamp" =\> "string" } } date { match =\> ["timestamp", "yyyy-MM-dd'T'HH:mm:ss'.'SSS'Z'"] timezone =\> "UCT" target =\> "timestamp" } } output{ stdout {codec =\> rubydebug} } Logstash Output : [vraghav\_dev@sl73elkapq001 vraghav\_dev] /usr/share/logstash/bin/logstash --path.settings /opt/wiprotemp/vraghav\_dev/ --path.data /opt/wiprotemp/vraghav\_dev/output62 -f /opt/wiprotemp/vraghav\_dev/date.conf Could not find log4j2 configuration at path /opt/wiprotemp/vraghav\_dev/log4j2.properties. Using default config which logs errors to the console [WARN] 2019-08-13 03:01:10.782 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified [FATAL] 2019-08-13 03:01:10.844 [LogStash::Runner] runner - Logstash could not be started because there is already another instance using the configured data directory. If you wish to run multiple instances, you must change the "path.data" setting. [ERROR] 2019-08-13 03:01:10.874 [LogStash::Runner] Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit [vraghav\_dev@sl73elkapq001 vraghav\_dev] /usr/share/logstash/bin/logstash --path.settings /opt/wiprotemp/vraghav\_dev/ --path.data /opt/wiprotemp/vraghav\_dev/output63 -f /opt/wiprotemp/vraghav\_dev/date.conf Could not find log4j2 configuration at path /opt/wiprotemp/vraghav\_dev/log4j2.properties. Using default config which logs errors to the console [INFO] 2019-08-13 03:02:21.859 [main] writabledirectory - Creating directory {:setting=\>"path.queue", :path=\>"/opt/wiprotemp/vraghav\_dev/output63/queue"} [INFO] 2019-08-13 03:02:21.871 [main] writabledirectory - Creating directory {:setting=\>"path.dead\_letter\_queue", :path=\>"/opt/wiprotemp/vraghav\_dev/output63/dead\_letter\_queue"} [WARN] 2019-08-13 03:02:22.574 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified [INFO] 2019-08-13 03:02:22.594 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=\>"7.0.1"} [INFO] 2019-08-13 03:02:22.640 [LogStash::Runner] agent - No persistent UUID file found. Generating new UUID {:uuid=\>"9ca2669c-9feb-4205-ab9e-19fc826de178", :path=\>"/opt/wiprotemp/vraghav\_dev/output63/uuid"} [INFO] 2019-08-13 03:02:34.756 [[main]-pipeline-manager] javapipeline - Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>2, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50, "pipeline.max\_inflight"=\>250, :thread=\>"#\"} [INFO] 2019-08-13 03:02:35.482 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=\>"main"} [INFO] 2019-08-13 03:02:35.748 [Ruby-0-Thread-1: /usr/share/logstash/lib/bootstrap/environment.rb:6] agent - Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>} [INFO] 2019-08-13 03:02:35.756 [[main]\9602} /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/awesome\_print-1.7.0/lib/awesome\_print/formatters/base\_formatter.rb:31: warning: constant ::Fixnum is deprecated { "host" =\> "[sl73elkapq001.visa.com](http://sl73elkapq001.visa.com)", "@version" =\> "1", "message" =\> "2019-08-12T03:10:01.087Z", "path" =\> "/opt/wiprotemp/vraghav\_dev/date.log", "@timestamp" =\> 2019-08-13T03:02:37.022Z } Note : I want date should be in below format `Aug 12, 2019 @ 23:04:53.167` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 10, 2019, 3:19am UTC](https://discuss.elastic.co/t/dateparseerror/194889/7 "2019-09-10T03:19:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.