# Elasticsearch won't accept logs using standard syslog date format
**URL:** https://discuss.elastic.co/t/elasticsearch-wont-accept-logs-using-standard-syslog-date-format/179962
**Category:** Elasticsearch
**Created:** [May 7, 2019, 12:01pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-accept-logs-using-standard-syslog-date-format/179962 "2019-05-07T12:01:38Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@elasticSmash](https://discuss.elastic.co/u/elasticSmash)
#### Post date: [May 7, 2019, 12:01pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-accept-logs-using-standard-syslog-date-format/179962/1 "2019-05-07T12:01:39Z")
On the logstash forum, they said that my question had more to do with elasticsearch, so here I am.
So far I've added hosts to my logstash input that have used ISO8601 time format in their syslog config. Those have imported ok and the date/time is interpreted into the timestamp field. I have the following stanza in my logstash.conf:
```
date {
locale => "en"
match => ["timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss", "ISO8601"]
}
```
I then tried to add a host that has the default syslog date format of MMM dd HH:mm:ss and Elasticsearch is choking on it's date for some reason with the following error:
> [2019-05-06T06:31:23,884][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"logstash-2019.05.06", :\_type=\>"syslog", :\_routing=\>nil}, 2019-05-06T10:31:18.000Z {name=ludwig, id=081a9a13d60d41deb4c6e2229bdc197a, os={name=Ubuntu, family=debian, version=18.10 (Cosmic Cuttlefish), platform=ubuntu, codename=cosmic}, containerized=false, architecture=x86\_64} May 6 06:31:18 ludwig nm-dispatcher: req:1 'dhcp4-change' [enp3s0]: start running ordered scripts...], :response=\>{"index"=\>{"\_index"=\>"logstash-2019.05.06", "\_type"=\>"syslog", "\_id"=\>"AWqMsrflWmfBzhmpAUtm", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [timestamp]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Invalid format: "May 6 06:31:18""}}}}}
I see that the error is invalid format for the date, but I don't understand how it doesn't match.
---
### Author:  [@elasticSmash](https://discuss.elastic.co/u/elasticSmash)
#### Post date: [May 8, 2019, 11:36am UTC](https://discuss.elastic.co/t/elasticsearch-wont-accept-logs-using-standard-syslog-date-format/179962/2 "2019-05-08T11:36:36Z")
_bump_ I'm new to ES so I assume this isn't a complex issue. And for the most part I'm just using info from tutorials. Thanks.
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [May 8, 2019, 11:38am UTC](https://discuss.elastic.co/t/elasticsearch-wont-accept-logs-using-standard-syslog-date-format/179962/3 "2019-05-08T11:38:09Z")
Read [this](https://discuss.elastic.co/t/about-the-elasticsearch-category/21) and specifically the "Also be patient" part.
It's fine to answer on your own thread after 2 or 3 days (not including weekends) if you don't have an answer.
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [May 8, 2019, 11:39am UTC](https://discuss.elastic.co/t/elasticsearch-wont-accept-logs-using-standard-syslog-date-format/179962/4 "2019-05-08T11:39:36Z")
What does a typical document Logstash is sending to elasticsearch? Could you provide one?
What is the elasticsearch mapping?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 5, 2019, 11:39am UTC](https://discuss.elastic.co/t/elasticsearch-wont-accept-logs-using-standard-syslog-date-format/179962/5 "2019-06-05T11:39:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.