# Error In Logstash Filter

**URL:** <https://discuss.elastic.co/t/error-in-logstash-filter/147237>\
**Category:** Logstash\
**Created:** [September 4, 2018, 3:11pm UTC](https://discuss.elastic.co/t/error-in-logstash-filter/147237 "2018-09-04T15:11:38Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![marcos.vbp](https://avatars.discourse-cdn.com/v4/letter/m/c5a1d2/32.png) [@marcos.vbp](https://discuss.elastic.co/u/marcos.vbp)\
**Post date:** [September 4, 2018, 3:11pm UTC](https://discuss.elastic.co/t/error-in-logstash-filter/147237/1 "2018-09-04T15:11:38Z")

</div>

hi,

My log : 172.16.2.211 - - [04/Set/2018:12:09:48 -0300] "GET /lmsa/framebottom.do HTTP/1.1" 200 4858

match =\> { message =\> "%{IP:client} %{DATA:USERNAME} %{DATA:USERNAME} [%{DATA:logtime}] **"** %{WORD:request} %{URIPATHPARAM:path} HTTP/%{NUMBER:versioni} **"** %{NUMBER:response} %{GREEDYDATA:responseMessage}" }

date{  
match =\> ["logtime","dd/MMM/yyy:HH:mm:ss Z"]  
target =\> "logtime"  
}

And before error change too.

{  
"host" =\> "brpoaelk01.mercurio.local",  
"path" =\> [  
[0] "/var/log/weblogic/producao/lms01/access.log",  
[1] "/lmsa/jsonbroker"  
],  
"versioni" =\> "1.1",  
"USERNAME" =\> [  
[0] "-",  
[1] "-"  
],  
"client" =\> "172.16.2.211",  
"@timestamp" =\> 2018-09-03T20:14:33.209Z,  
"@version" =\> "1",  
"request" =\> "POST",  
"response" =\> "200",  
"tags" =\> [  
[0] "\_dateparsefailure"  
],  
"message" =\> "172.16.2.211 - - [03/Set/2018:16:57:30 -0300] "POST /lmsa/jsonbroker HTTP/1.1" 200 958 ",  
"type" =\> "weblogic-access-lms01",  
"responseMessage" =\> "958 ",  
"logtime" =\> "03/Set/2018:16:57:30"  
}

I try use COMMONAPACHELOG, but dont work for me.  
Any help me pls ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 4, 2018, 7:50pm UTC](https://discuss.elastic.co/t/error-in-logstash-filter/147237/2 "2018-09-04T19:50:02Z")

</div>

The pattern in your date filter clearly doesn't match what's in the `logtime` field (the field doesn't have a timezone at the end). Also, the month name is in some language other than English so try setting the date filter's `locale` option to the name of a locale that matches the language of your month names.

---

<div class="post-metadata">

**Author:** ![marcos.vbp](https://avatars.discourse-cdn.com/v4/letter/m/c5a1d2/32.png) [@marcos.vbp](https://discuss.elastic.co/u/marcos.vbp)\
**Post date:** [September 4, 2018, 8:07pm UTC](https://discuss.elastic.co/t/error-in-logstash-filter/147237/3 "2018-09-04T20:07:51Z")

</div>

Magnus,

new filter :

filter {

grok {  
match =\> { message =\> "%{IP:client} %{DATA:USERNAME} %{DATA:USERNAME} [%{DATA:logtime}] "%{WORD:request} %{NOTSPACE:path} HTTP/%{NUMBER:versioni}" %{NUMBER:response} %{GREEDYDATA:responseMessage}" }

}  
mutate{  
#gsub =\> ["logtime"," -0300",""]  
remove\_field =\> ["message"]  
}

date{  
match =\> ["logtime","dd/MMM/yyy:HH:mm:ss Z"]  
target =\> "logtime"  
locale =\> "en"  
timezone =\> "America/Sao\_Paulo"  
}

}

new output is :

{  
"logtime" =\> "04/Set/2018:17:13:14 -0300",  
"type" =\> "weblogic-access-lms01",  
"path" =\> [  
[0] "/var/log/weblogic/producao/lms01/access.log",  
[1] "/lmsa/services/evento/doctoservico/integracaoFedexEntrega/enriqueceOcorrenciaEntrega"  
],  
"versioni" =\> "1.1",  
"@version" =\> "1",  
"request" =\> "POST",  
"client" =\> "172.16.2.206",  
"USERNAME" =\> [  
[0] "-",  
[1] "-"  
],  
"tags" =\> [  
[0] "\_dateparsefailure"  
],  
"responseMessage" =\> "0 ",  
"response" =\> "200",  
"host" =\> "brpoaelk01.mercurio.local",  
"@timestamp" =\> 2018-09-04T20:13:15.333Z  
}

same error

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 4, 2018, 8:26pm UTC](https://discuss.elastic.co/t/error-in-logstash-filter/147237/4 "2018-09-04T20:26:19Z")

</div>

As I said, set the `locale` option to the language your month names are in. "Set" is not English.

---

<div class="post-metadata">

**Author:** ![marcos.vbp](https://avatars.discourse-cdn.com/v4/letter/m/c5a1d2/32.png) [@marcos.vbp](https://discuss.elastic.co/u/marcos.vbp)\
**Post date:** [September 4, 2018, 8:30pm UTC](https://discuss.elastic.co/t/error-in-logstash-filter/147237/5 "2018-09-04T20:30:49Z")

</div>

Magnus,

I try locale =\> "pt-BR" or "en" , and error is the same . Sorry i forget said this.

---

<div class="post-metadata">

**Author:** ![marcos.vbp](https://avatars.discourse-cdn.com/v4/letter/m/c5a1d2/32.png) [@marcos.vbp](https://discuss.elastic.co/u/marcos.vbp)\
**Post date:** [September 6, 2018, 6:37pm UTC](https://discuss.elastic.co/t/error-in-logstash-filter/147237/6 "2018-09-06T18:37:20Z")

</div>

Somebody help ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 4, 2018, 6:37pm UTC](https://discuss.elastic.co/t/error-in-logstash-filter/147237/7 "2018-10-04T18:37:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.