# \_dateparsefailure in ISO8601 date strings **URL:** \ **Category:** Logstash\ **Created:** [December 23, 2021, 12:22pm UTC](https://discuss.elastic.co/t/dateparsefailure-in-iso8601-date-strings/292799 "2021-12-23T12:22:48Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![bitnapper](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bitnapper/32/96566_2.png) [@bitnapper](https://discuss.elastic.co/u/bitnapper)\ **Post date:** [December 23, 2021, 12:22pm UTC](https://discuss.elastic.co/t/dateparsefailure-in-iso8601-date-strings/292799/1 "2021-12-23T12:22:48Z")
I want to pull logs from an mssql server and parse their date strings. unfortunately I can not figure out why it can not parse the date. My filter looks like this: filter { date { match =\> ["evtime", "ISO8601"] timezone =\> "UTC" target =\> "@timestamp" add\_field =\> { "debug" =\> "timestampMatched"} } fingerprint { source =\> ["@timestamp", "evhost", "evinfo"] method =\> "SHA1" target =\> "[@metadata][generated\_id]" } } It does not work if there is a timezone option or not. The entrys logstash produces look like this: { "evuser":null, "evhost":"host", "evinfo":"Filter: xxx", "tags":["\_dateparsefailure"], "@version":"1", "evtime":"2021-05-14T18:02:32.000Z", "@timestamp":"2021-12-23T12:08:00.750Z" } Any hints whats wrong with my timestamps? ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [December 23, 2021, 12:54pm UTC](https://discuss.elastic.co/t/dateparsefailure-in-iso8601-date-strings/292799/2 "2021-12-23T12:54:26Z")
Not sure why are seeing that. I tested the exact same and get the right results. **Conf** ```auto input { generator { message => '{ "evtime":"2021-05-14T18:02:32.000Z" }' count => 1 codec => "json" } } filter { date { match => ["evtime", "ISO8601"] timezone => "UTC" target => "@timestamp" add_field => { "debug" => "timestampMatched"} } } output { stdout { codec => "json" } } ``` **Output** ```auto { "@version": "1", "sequence": 0, "evtime": "2021-05-14T18:02:32.000Z", "@timestamp": "2021-05-14T18:02:32.000Z", "debug": "timestampMatched", "host": "Aarons-MBP" } ``` ---
**Author:** ![bitnapper](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bitnapper/32/96566_2.png) [@bitnapper](https://discuss.elastic.co/u/bitnapper)\ **Post date:** [December 27, 2021, 9:48am UTC](https://discuss.elastic.co/t/dateparsefailure-in-iso8601-date-strings/292799/3 "2021-12-27T09:48:40Z")
I'm a bit suprised that it works for you. I can't find anything why it might not but it doesn't. Starting logstahs with --debug doesn't give any hint that it can't process the date string. Is there another way to get the date filter to give more information thand adding [`tag_on_failure`]? ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [December 27, 2021, 4:07pm UTC](https://discuss.elastic.co/t/dateparsefailure-in-iso8601-date-strings/292799/4 "2021-12-27T16:07:56Z")
The only thing I can't see in your configuration that I do different is using the `json` codec. Do you at some point use that codec or json filter? ---
**Author:** ![bitnapper](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bitnapper/32/96566_2.png) [@bitnapper](https://discuss.elastic.co/u/bitnapper)\ **Post date:** [December 28, 2021, 10:28am UTC](https://discuss.elastic.co/t/dateparsefailure-in-iso8601-date-strings/292799/5 "2021-12-28T10:28:34Z")
I hadn't configured it explicitly, the JDBC Plugin already gives it as JSON. But when I configure json explicitly it doesn't change. It still does not process the date without giving any hint on why. The fingerprinting-filter does work so I guess it is not a problem of reading the input in general. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [December 28, 2021, 2:19pm UTC](https://discuss.elastic.co/t/dateparsefailure-in-iso8601-date-strings/292799/6 "2021-12-28T14:19:38Z")
I wonder if you are hitting [this](https://github.com/logstash-plugins/logstash-filter-date/issues/95) issue. The jdbc input will convert date/time columns into LogStash::Timestamp objects, which a date filter cannot parse. You could try using mutate+convert to make [evtime] a string before parsing it. ---
**Author:** ![bitnapper](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bitnapper/32/96566_2.png) [@bitnapper](https://discuss.elastic.co/u/bitnapper)\ **Post date:** [December 28, 2021, 4:09pm UTC](https://discuss.elastic.co/t/dateparsefailure-in-iso8601-date-strings/292799/7 "2021-12-28T16:09:17Z")
Thanks a lot @Badger, this seems to be the problem. Not that I'm suprised. Since I started with elastic in June I found bug after bug. Since elastic had this logstash prepared for me, saying „this should work“ I thought it might be a problem with my environment. But I'll test it after the holidays and ask them to have a look. ---
**Author:** ![bitnapper](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bitnapper/32/96566_2.png) [@bitnapper](https://discuss.elastic.co/u/bitnapper)\ **Post date:** [January 3, 2022, 11:40am UTC](https://discuss.elastic.co/t/dateparsefailure-in-iso8601-date-strings/292799/8 "2022-01-03T11:40:01Z")
So, after the holidays I had the time to test it and it is definateley that [issue](https://github.com/logstash-plugins/logstash-filter-date/issues/95). It is a bit frustrating that the documentation doesn't mention that the input type for date hast to be a string and that there is no useful error message suggesting the type mismatch. That could have saved me a lot of time but at least it is consistend with what I saw when encountering bugs in the other elastic components. So if anyone else stumbles onto this thread: The jdbc plugin seem to receive dates as type date. The date filter isn't able to process dates as dates and wants a string (but doesnt tell you... because its a log funnier to have this bug for over 3 years and let everyone stumble over it). Fix: ```auto filter { mutate { convert => {"date_fileld" => "string"} } date { match => ["date_fileld", "ISO8601"] } } ``` Many thanks @Badger for pointing me to that issue. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 31, 2022, 11:41am UTC](https://discuss.elastic.co/t/dateparsefailure-in-iso8601-date-strings/292799/9 "2022-01-31T11:41:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.