# \_dateparsefailure problem

**URL:** <https://discuss.elastic.co/t/dateparsefailure-problem/188216>\
**Category:** Logstash\
**Created:** [July 1, 2019, 1:41am UTC](https://discuss.elastic.co/t/dateparsefailure-problem/188216 "2019-07-01T01:41:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![trx](https://avatars.discourse-cdn.com/v4/letter/t/ecc23a/32.png) [@trx](https://discuss.elastic.co/u/trx)\
**Post date:** [July 1, 2019, 1:41am UTC](https://discuss.elastic.co/t/dateparsefailure-problem/188216/1 "2019-07-01T01:41:54Z")

</div>

Hi, I have been trying to replace my @timestamps from my syslog

Have used this example:

> **[Logstash configuration examples | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/config-examples.html)**

I really don't understand why it's not working!

I looked at this topic:

> [@Can't replace timestamp , getting \[1\] "\_dateparsefailure"](https://discuss.elastic.co/t/cant-replace-timestamp-getting-1--dateparsefailure/72520/6):
>
> Input string is i.e. all dates like 2017/20/01 13:53:35 I am using bold one in above 'date' after 'csv' \<141\>Nov 3 12:53:35 DC1. 1,2017/20/01 13:53:35,001901000999,THREAT,file,1,2017/20/01 13:53:35,1.1.1.1,2.2.2.2,0.0.0.0,0.0.0.0,RULE fake,me,,APP test,vsys1,app,rep,ae1.2,ae2.1,LF-elk,2017/20/01 13:53:35,33891243,1,445,66666,0,0,0x0,tcp,test,"WebFix.exe",Microsoft PE File(52060),any,low,server-to-client,5210010,0x0,10.0.0.0-10.255.255.255,10.0.0.0-10.255.255.255,0,,0,,,0,,,,,,,,0,38,0,0,0,PRO…

And @magnusbaeck gave the following test to the OP to try:

`echo '2017/20/01 13:53:35' | logstash -e 'input { stdin { } } output { stdout { codec => rubydebug } } filter { date { match => ["message", "YYYY/dd/MM HH:mm:ss"] } }'`

which works on my system

When i do a similar thing with the [example](https://www.elastic.co/guide/en/logstash/current/config-examples.html):

`echo 'Jun 30 12:36:24' | ./logstash -e 'input { stdin { } } output { stdout { codec => rubydebug } } filter { date { match => ["message", "MMM dd HH:mm:ss"] } }'`

I get the following error:

```
[2019-07-01T11:40:33,429][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
/home/linux/Downloads/logstash-7.1.1/vendor/bundle/jruby/2.5.0/gems/awesome_print-1.7.0/lib/awesome_print/formatters/base_formatter.rb:31: warning: constant ::Fixnum is deprecated
{
      "@version" => "1",
    "@timestamp" => 2019-07-01T01:40:32.830Z,
          "tags" => [
        [0] "_dateparsefailure"
    ],
          "host" => "LINUX",
       "message" => "Jun 30 12:36:24"
}

```

Why is that?  
Thanks for any help

---

<div class="post-metadata">

**Author:** ![trx](https://avatars.discourse-cdn.com/v4/letter/t/ecc23a/32.png) [@trx](https://discuss.elastic.co/u/trx)\
**Post date:** [July 1, 2019, 1:54am UTC](https://discuss.elastic.co/t/dateparsefailure-problem/188216/2 "2019-07-01T01:54:55Z")

</div>

worked it out.  
in case anyone else is going nuts with this, you need to set the locale to "en"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 29, 2019, 1:54am UTC](https://discuss.elastic.co/t/dateparsefailure-problem/188216/3 "2019-07-29T01:54:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.