# ES and logstash randomly start throwing exception: failed to parse \[timestamp\]

**URL:** <https://discuss.elastic.co/t/es-and-logstash-randomly-start-throwing-exception-failed-to-parse-timestamp/44968>\
**Category:** Logstash\
**Created:** [March 21, 2016, 9:43am UTC](https://discuss.elastic.co/t/es-and-logstash-randomly-start-throwing-exception-failed-to-parse-timestamp/44968 "2016-03-21T09:43:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![varh1i](https://avatars.discourse-cdn.com/v4/letter/v/51bf81/32.png) [@varh1i](https://discuss.elastic.co/u/varh1i)\
**Post date:** [March 21, 2016, 9:43am UTC](https://discuss.elastic.co/t/es-and-logstash-randomly-start-throwing-exception-failed-to-parse-timestamp/44968/1 "2016-03-21T09:43:58Z")

</div>

I have an ELK stack running and at some point it starts throwing: "IllegalArgumentException[Invalid format: "Mar 20 02:00:06"];" After restarting logstash it works fine again. When I try to parse the line that gave the error again, it parses it just fine. Is it an ES or logstash bug?

Example log line to parse:  
"Mar 21 01:59:59 136.244.34.211 INFO krdxStats ,0,,sobasnvved1ure6l7683a6djo2,com\_krdx\_search,,,report,10753953,67.249.78.11,67.249.78.11,2016-03-21 1:59:59,krdxCompanyDetails,getDetails,cnt:1"

Grok pattern:  
filter {  
if [type] == "project" {  
grok {  
match =\> ["message", "(?%{MONTH} (?:(?:[ 0][1-9])|(?:[12][0-9])|(?:3[01])|[1-9]) %{TIME}) %{IP:app\_ip} %{LOGLEVEL:level} %{WORD:logger} ,%{NUMBER:username},(?:%{DATA:user\_fullname}|),(?:%{DATA:cookie}|),(?:%{DATA:web\_app\_component}|),(?:%{DATA:}|),(?:%{DATA:controller}|),(?:%{DATA:view}|),(?:%{DATA:query\_subject\_id}|),(?:%{IP:client\_ip}|),(?:%{IP:}|),(?:%{TIMESTAMP\_ISO8601:method\_call\_time}|),(?:%{WORD:class\_name}|),(?:%{WORD:method\_name}|)(?:,%{GREEDYDATA:method\_response}|)" ]  
}  
date {  
match =\> ["method\_call\_time" , "yyyy-MM-dd' 'HH:mm:ss"]  
timezone =\> "Europe/Tallinn"  
}  
}  
}

ES log:  
[2016-03-19 23:59:59,999][DEBUG][action.bulk] [Venus Dee Milo] [logstash-project-2016.03.20][1] failed to execute bulk item (index) index {[logstash-project-2016.03.20][project][AVORUj5u9MXhDshT2kQv], source[{"message":"Mar 20 02:00:06 136.244.34.211 INFO krdxStats ,0,,vve7g2tohjjnja055c6tb112g6,com\_krdx\_search,,,comments,11940893,15.255.253.93,15.255.253.93,2016-03-20 2:00:06,krdxPersonMain,getPersonData,dataType:avatar,cnt:1","@version":"1","@timestamp":"2016-03-20T00:00:06.000Z","beat":{"hostname":"project","name":"project"},"count":1,"fields":null,"input\_type":"log","offset":322435950,"source":"/opt/log/project/2016/03/20/project.log","type":"project","host":"project","timestamp":"Mar 20 02:00:06","app\_ip":"136.244.34.211","level":"INFO","logger":"krdxStats","username":"0","cookie":"vve7g2tohjjnja055c6tb112g6","web\_app\_component":"com\_krdx\_search","view":"comments","query\_subject\_id":"11940893","client\_ip":"15.255.253.93","method\_call\_time":"2016-03-20 2:00:06","class\_name":"krdxPersonMain","method\_name":"getPersonData","method\_response":"dataType:avatar,cnt:1"}]}  
MapperParsingException[failed to parse [timestamp]]; nested: IllegalArgumentException[Invalid format: "Mar 20 02:00:06"];

Logstash log:

{: timestamp =\> "2016-03-20T23:59:53.306000+0000", : message =\> "Failed action. ", : status =\> 400, : action =\> ["index", {: \_id =\> nil,  
: \_index =\> "logstash-project-2016.03.20",  
: \_type =\> "project",  
: \_routing =\> nil  
..... lot more stuff here ....  
\>\> ], : response =\> {  
"create" =\> {  
"\_index" =\> "logstash-project-2016.03.20", "\_type" =\> "project", "\_id" =\> "AVOWeHM-9MXhDshTKxOr", "status" =\> 400, "error" =\> {  
"type" =\> "mapper\_parsing\_exception", "reason" =\> "failed to parse [timestamp]", "caused\_by" =\> {  
"type" =\> "illegal\_argument\_exception", "reason" =\> "Invalid format: "Mar 21 01:59:59""  
}  
}  
}  
}, : level =\> : warn  
}

---

<div class="post-metadata">

**Author:** ![jarlrmai](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jarlrmai/32/11574_2.png) [@jarlrmai](https://discuss.elastic.co/u/jarlrmai)\
**Post date:** [September 26, 2016, 10:35am UTC](https://discuss.elastic.co/t/es-and-logstash-randomly-start-throwing-exception-failed-to-parse-timestamp/44968/2 "2016-09-26T10:35:11Z")

</div>

I'm having the same issue, did you ever resolve it?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:36am UTC](https://discuss.elastic.co/t/es-and-logstash-randomly-start-throwing-exception-failed-to-parse-timestamp/44968/3 "2017-07-06T04:36:56Z")

</div>