# Failed parsing date from field using logstash **URL:** \ **Category:** Logstash\ **Created:** [May 31, 2016, 6:52am UTC](https://discuss.elastic.co/t/failed-parsing-date-from-field-using-logstash/51384 "2016-05-31T06:52:13Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![r.ganeshbabu](https://avatars.discourse-cdn.com/v4/letter/r/4da419/32.png) [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\ **Post date:** [May 31, 2016, 6:52am UTC](https://discuss.elastic.co/t/failed-parsing-date-from-field-using-logstash/51384/1 "2016-05-31T06:52:13Z")
Hi All, I trying to index sample log files to ES using logstash and below is the logstash conf file, input { file { type =\> "apache" path =\> "/opt/esadmin/elasticsearch-1.7.3/bin/logstash-1.5.5/logging\_AdminServer.log" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } filter { grok { match =\> ["message", "%{MONTHDAY:monthday}-%{MONTH:month}-%{YEAR:year}\s\*%{TIME:StartTime}\s\*%{TIME:EndTime}\s\*%{TIME:ElapseTime}\s\*%{WORD:External\_Itemcode}\s\*%{NUMBER:User\_id} %{GREEDYDATA:Event\_name}"] } ``` mutate { add_field => { "Date" => "%{monthday}-%{month}-%{year}" } } date { match => ["Date" , "dd-MMM-yyyy"] locale => "en" } mutate { remove_field => ["month", "monthday", "year"] } ``` } output { elasticsearch { host =\> "10.8.157.24:9200" protocol =\> "http" user =\> "esadmin" password =\> "password" } stdout { codec =\> "dots" } } and I am getting the following error response when I executing logstash.conf file, Failed parsing date from field {:field=\>"Date", :value=\>"%{monthday}-%{month}-%{year}", :exception=\>"Invalid format: "%{monthday}-%{month}-%{year}"", :config\_parsers=\>"dd-MMM-yyyy", :config\_locale=\>"en", :level=\>:warn} Logstash startup completed ..................... Logstash shutdown completed Please let us know your suggestions. Thanks, Ganeshbabu R ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 31, 2016, 7:05am UTC](https://discuss.elastic.co/t/failed-parsing-date-from-field-using-logstash/51384/2 "2016-05-31T07:05:00Z")
What does your input data look like? ---
**Author:** ![r.ganeshbabu](https://avatars.discourse-cdn.com/v4/letter/r/4da419/32.png) [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\ **Post date:** [May 31, 2016, 7:13am UTC](https://discuss.elastic.co/t/failed-parsing-date-from-field-using-logstash/51384/3 "2016-05-31T07:13:25Z")
Hi @warkolm, Below is the sample input data, Date StartTime EndTime ElapseTime External\_Itemcode User\_id Event\_name 26-May-2016 05:11:25 05:12:50 00:01:25 0124524554 3024 Loading loadItemstoWorkspace Details 26-May-2016 05:14:34 05:15:28 00:00:54 0124524554 3024 Loading loadItemstoWorkspace Details 26-May-2016 05:17:22 05:17:30 00:00:08 0124524554 3024 Create Nielsen Item 26-May-2016 05:18:19 05:18:46 00:00:26 0124524554 4137 Loading UpdateCharacteristicValues Details Thanks, Ganeshbabu R ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 31, 2016, 7:35am UTC](https://discuss.elastic.co/t/failed-parsing-date-from-field-using-logstash/51384/4 "2016-05-31T07:35:58Z")
Your `Date` field doesn't contain the date but the string "%{monthday}-%{month}-%{year}", which indicates that your grok filter failed. ---
**Author:** ![r.ganeshbabu](https://avatars.discourse-cdn.com/v4/letter/r/4da419/32.png) [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\ **Post date:** [May 31, 2016, 7:58am UTC](https://discuss.elastic.co/t/failed-parsing-date-from-field-using-logstash/51384/5 "2016-05-31T07:58:33Z")
> [@r.ganeshbabu](#): > > mutate { > add\_field =\> { > "Date" =\> "%{monthday}-%{month}-%{year}" > } > } > date { > match =\> ["Date" , "dd-MMM-yyyy"] > target =\> "Date" > locale =\> "en" > } Hi @magnusbaeck, In our sample log data we have the header "Date" so we trying to add the date as "new field" with the format "dd-MMM-yyyy" Is there any other workaround activity? Thanks, Ganeshbabu R ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 31, 2016, 8:02am UTC](https://discuss.elastic.co/t/failed-parsing-date-from-field-using-logstash/51384/6 "2016-05-31T08:02:46Z")
As I said, I don't think your grok filter is working properly. If you fix that the date parsing problem will be resolved too. I suggest you temporarily replace your elasticsearch output with a `stdout { codec => rubydebug }` output until you've debugged this problem. If you show the Logstash output with this stdout output it'll be easier to help. ---
**Author:** ![r.ganeshbabu](https://avatars.discourse-cdn.com/v4/letter/r/4da419/32.png) [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\ **Post date:** [May 31, 2016, 9:11am UTC](https://discuss.elastic.co/t/failed-parsing-date-from-field-using-logstash/51384/7 "2016-05-31T09:11:15Z")
Hi @magnusbaeck Please find the below response of the logstash output, Failed parsing date from field {:field=\>"Date", :value=\>"%{monthday}-%{month}-%{year}", :exception=\>"Invalid format: "%{monthday}-%{month}-%{year}"", :config\_parsers=\>"dd-MMM-yyyy", :config\_locale=\>"en", :level=\>:warn} Logstash startup completed { "message" =\> "Date StartTime EndTime ElapseTime External\_Itemcode User\_id Event\_name", "@version" =\> "1", "@timestamp" =\> "2016-05-31T09:04:25.956Z", "host" =\> "[dayrhebfmd001.enterprisenet.org](http://dayrhebfmd001.enterprisenet.org)", "path" =\> "/opt/esadmin/elasticsearch-1.7.3/bin/logstash-1.5.5/logging\_AdminServer.log", "type" =\> "apache", "tags" =\> [ [0] "\_grokparsefailure", [1] "\_dateparsefailure" ], "Date" =\> "%{monthday}-%{month}-%{year}" } { "message" =\> "26-May-2016\t05:11:25 05:12:50 00:01:25 0124524554 3024 Loading loadItemstoWorkspace Details", "@version" =\> "1", "@timestamp" =\> "2016-05-31T09:04:25.958Z", "host" =\> "[dayrhebfmd001.enterprisenet.org](http://dayrhebfmd001.enterprisenet.org)", "path" =\> "/opt/esadmin/elasticsearch-1.7.3/bin/logstash-1.5.5/logging\_AdminServer.log", "type" =\> "apache", "StartTime" =\> "05:11:25", "EndTime" =\> "05:12:50", "ElapseTime" =\> "00:01:25", "External\_Itemcode" =\> "0124524554", "User\_id" =\> "3024", "Event\_name" =\> " Loading loadItemstoWorkspace Details", "Date" =\> "2016-05-26T04:00:00.000Z" } { "message" =\> "26-May-2016\t05:14:34 05:15:28 00:00:54 0124524554 3024 Loading loadItemstoWorkspace Details", "@version" =\> "1", "@timestamp" =\> "2016-05-31T09:04:25.958Z", "host" =\> "[dayrhebfmd001.enterprisenet.org](http://dayrhebfmd001.enterprisenet.org)", "path" =\> "/opt/esadmin/elasticsearch-1.7.3/bin/logstash-1.5.5/logging\_AdminServer.log", "type" =\> "apache", "StartTime" =\> "05:14:34", "EndTime" =\> "05:15:28", "ElapseTime" =\> "00:00:54", "External\_Itemcode" =\> "0124524554", "User\_id" =\> "3024", "Event\_name" =\> " Loading loadItemstoWorkspace Details", "Date" =\> "2016-05-26T04:00:00.000Z" } { "message" =\> "", "@version" =\> "1", "@timestamp" =\> "2016-05-31T09:04:25.960Z", "host" =\> "[dayrhebfmd001.enterprisenet.org](http://dayrhebfmd001.enterprisenet.org)", "path" =\> "/opt/esadmin/elasticsearch-1.7.3/bin/logstash-1.5.5/logging\_AdminServer.log", "type" =\> "apache", "tags" =\> [ [0] "\_grokparsefailure", [1] "\_dateparsefailure" ], "Date" =\> "%{monthday}-%{month}-%{year}" } failed action with response of 400, dropping action: ["index", {:\_id=\>nil, :\_index=\>"logstash-2016.05.31", :\_type=\>"apache", :\_routing=\>nil}, #\"/opt/esadmin/elasticsearch-1.7.3/bin/logstash-1.5.5/logging\_AdminServer.log", "retry\_count"=\>0}, @lut={"[path]"=\>[{"path"=\>"/opt/esadmin/elasticsearch-1.7.3/bin/logstash-1.5.5/logging\_AdminServer.log", "retry\_count"=\>0}, "path"]}\>, @cancelled=false, @data={"message"=\>"Date StartTime EndTime ElapseTime External\_Itemcode User\_id Event\_name", "@version"=\>"1", "@timestamp"=\>"2016-05-31T09:04:25.956Z", "host"=\>"[dayrhebfmd001.enterprisenet.org](http://dayrhebfmd001.enterprisenet.org)", "path"=\>"/opt/esadmin/elasticsearch-1.7.3/bin/logstash-1.5.5/logging\_AdminServer.log", "type"=\>"apache", "tags"=\>["\_grokparsefailure", "\_dateparsefailure"], "Date"=\>"%{monthday}-%{month}-%{year}"}, @metadata={"path"=\>"/opt/esadmin/elasticsearch-1.7.3/bin/logstash-1.5.5/logging\_AdminServer.log", "retry\_count"=\>0}, @accessors=#\"Date StartTime EndTime ElapseTime External\_Itemcode User\_id Event\_name", "@version"=\>"1", "@timestamp"=\>"2016-05-31T09:04:25.956Z", "host"=\>"[dayrhebfmd001.enterprisenet.org](http://dayrhebfmd001.enterprisenet.org)", "path"=\>"/opt/esadmin/elasticsearch-1.7.3/bin/logstash-1.5.5/logging\_AdminServer.log", "type"=\>"apache", "tags"=\>["\_grokparsefailure", "\_dateparsefailure"], "Date"=\>"%{monthday}-%{month}-%{year}"}, @lut={"host"=\>[{"message"=\>"Date StartTime EndTime ElapseTime External\_Itemcode User\_id Event\_name", "@version"=\>"1", "@timestamp"=\>"2016-05-31T09:04:25.956Z", "host"=\>"[dayrhebfmd001.enterprisenet.org](http://dayrhebfmd001.enterprisenet.org)", Pls let us know your feedback.. Thanks, Ganeshbabu R ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 31, 2016, 9:27am UTC](https://discuss.elastic.co/t/failed-parsing-date-from-field-using-logstash/51384/8 "2016-05-31T09:27:04Z")
The grok filter and your date filter work just fine for correct input (the second and third messages) but fails for empty lines and the first line which contains a list of column headers. This is expected. Perhaps you should drop the column headers and empty lines using a drop filter that you wrap in a conditional. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:55am UTC](https://discuss.elastic.co/t/failed-parsing-date-from-field-using-logstash/51384/9 "2017-07-06T04:55:20Z")