# Dateparsefailure error logstash

**URL:** <https://discuss.elastic.co/t/dateparsefailure-error-logstash/274806>\
**Category:** Logstash\
**Created:** [June 2, 2021, 10:57pm UTC](https://discuss.elastic.co/t/dateparsefailure-error-logstash/274806 "2021-06-02T22:57:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![byakko1234](https://avatars.discourse-cdn.com/v4/letter/b/cab0a1/32.png) [@byakko1234](https://discuss.elastic.co/u/byakko1234)\
**Post date:** [June 2, 2021, 10:57pm UTC](https://discuss.elastic.co/t/dateparsefailure-error-logstash/274806/1 "2021-06-02T22:57:30Z")

</div>

Hi everyone.

I´m trying to use the date filter without any luck. I want to create a new field that is the combination of the %{date} and %{time} in my grok and have this new field to have a date type value.

Any help is appreciated.

### Config

input {  
beats {  
port =\> 5044  
}  
}

filter {  
mutate {  
gsub =\> ["message", "\x1B[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K]", ""]  
}

grok {  
match =\> {  
"message" =\> ["%{DATE\_US:date} %{TIME:time} %{IP}-%{WORD} (%{DATA}\ (%{DATA}) %{WORD} (%{DATA}) %{WORD} %{WORD} %{WORD}: (?[^\*). %{WORD} %{WORD} %{WORD} %{WORD} %{NUMBER:device\_id} %{WORD} %{WORD} %{IP:device\_ip}"]  
}  
}

mutate {  
add\_field =\> {"receive\_at" =\> "%{date} %{time}"} }

date {  
match =\> ["receive\_at", "MM/dd/yyyy HH:mm:ss"]  
target =\> "@timestamp"  
remove\_field =\> ["receive\_at", "date", "time"]  
}

if "\_grokparsefailure" in [tags] {  
drop { }  
}

}

output {  
elasticsearch {  
hosts =\> "${ELASTICSEARCH\_HOST\_PORT}"  
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}"  
user =\> "${ELASTIC\_USERNAME}"  
password =\> "${ELASTIC\_PASSWORD}"  
}  
}

This is the date format in my logs that I´m trying to fix:

05/24/2021 17:21:04,073

I also tried with:

date {  
match =\> ["receive\_at", "MM/dd/yyyy HH:mm:ss.SSS"]  
target =\> "@timestamp"  
remove\_field =\> ["receive\_at", "date", "time"]  
}

### Output

"@timestamp": [  
"2021-06-02T21:28:06.942Z"

"receive\_at.keyword": [  
"05/28/2021 21:26:20,957"  
],

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 30, 2021, 10:58pm UTC](https://discuss.elastic.co/t/dateparsefailure-error-logstash/274806/2 "2021-06-30T22:58:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.