# Failed parsing date, linux syslog

**URL:** <https://discuss.elastic.co/t/failed-parsing-date-linux-syslog/44549>\
**Category:** Logstash\
**Created:** [March 16, 2016, 11:32am UTC](https://discuss.elastic.co/t/failed-parsing-date-linux-syslog/44549 "2016-03-16T11:32:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Willie\_Cadete](https://avatars.discourse-cdn.com/v4/letter/w/ecd19e/32.png) [@Willie\_Cadete](https://discuss.elastic.co/u/Willie_Cadete)\
**Post date:** [March 16, 2016, 11:32am UTC](https://discuss.elastic.co/t/failed-parsing-date-linux-syslog/44549/1 "2016-03-16T11:32:44Z")

</div>

Hello, Everyone

I'm having problems to parse field timestamp, it shoud be something simple but I'm not getting to see!  
I'm already here trying resolve this all day

log example:

Mar 8 03:34:15 fw01 block-INPUT IN=wan0 OUT= MAC=00:00:00:00:00:e3:10:f3:00:00:00:81:08:00 SRC=11.11.11.11 DST=22.22.22.22 LEN=48 TOS=00 PREC=0x00 TTL=119 ID=17927 DF PROTO=TCP SPT=0000 DPT=0000 SEQ=1837860932 ACK=0 WINDOW=8192 SYN URGP=0 MARK=1

config logstash:

```
input {
    stdin {type => "iptables"}
}

filter {
        if [type] == "iptables" {
        grok {
                        patterns_dir => "/opt/logstash/patterns"
                        match => { "message" => "%{IPTABLES}" }
            }

        date {
                        locale => "pt-BR"
                        match => ["timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
                        timezone => "America/Sao_Paulo"
            }
        }
    }

output {

    stdout {
            codec => "rubydebug"
        }
}

```

patterns:

```
NETFILTERMAC %{COMMONMAC:dst_mac}:%{COMMONMAC:src_mac}:%{ETHTYPE:ethtype}
ETHTYPE (?:(?:[A-Fa-f0-9]{2}):(?:[A-Fa-f0-9]{2}))
IPTABLES %{SYSLOGTIMESTAMP:timestamp}\s+%{HOSTNAME:source_host}\s+(?<chain>[A-Za-z0-9_-]+)?.*IN=%{WORD:in_interface}?.*OUT=(%{WORD:out_interface})?.*MAC=%{NETFILTERMAC}?.*SRC=%{IP:src_ip}?.*DST=%{IP:dst_ip}?.*TTL=%{INT:ttl}?.*PROTO=%{WORD:protocol}?.*SPT=%{INT:src_port}?.*DPT=%{INT:dst_port}

```

Output:

```
Failed parsing date from field {:field=>"timestamp", :value=>"Mar 8 03:34:15", :exception=>"Invalid format: \"Mar 8 03:34:15\"", :config_parsers=>"MMM d HH:mm:ss,MMM dd HH:mm:ss", :config_locale=>"pt-BR", :level=>:warn}
{
         "message" => "Mar 8 03:34:15 fw01 block-INPUT IN=wan0 OUT= MAC=00:00:00:00:00:e3:10:f3:00:00:00:81:08:00 SRC=11.11.11.11 DST=22.22.22.22 LEN=48 TOS=00 PREC=0x00 TTL=119 ID=17927 DF PROTO=TCP SPT=0000 DPT=0000 SEQ=1837860932 ACK=0 WINDOW=8192 SYN URGP=0 MARK=1",
        "@version" => "1",
      "@timestamp" => "2016-03-16T11:21:20.368Z",
            "type" => "iptables",
            "host" => "logstash01.srsp.dpf.gov.br",
       "timestamp" => "Mar 8 03:34:15",
     "source_host" => "fw01",
           "chain" => "block-INPUT",
    "in_interface" => "wan0",
         "dst_mac" => "00:00:00:00:00:e3",
         "src_mac" => "10:f3:00:00:00:81",
         "ethtype" => "08:00",
          "src_ip" => "11.11.11.11",
          "dst_ip" => "22.22.22.22",
             "ttl" => "119",
        "protocol" => "TCP",
        "src_port" => "0000",
        "dst_port" => "0000",
            "tags" => [
        [0] "_dateparsefailure"
    ]
}

```

Thanks!

---

<div class="post-metadata">

**Author:** ![wiibaa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wiibaa/32/44931_2.png) [@wiibaa](https://discuss.elastic.co/u/wiibaa)\
**Post date:** [March 16, 2016, 12:20pm UTC](https://discuss.elastic.co/t/failed-parsing-date-linux-syslog/44549/2 "2016-03-16T12:20:43Z")

</div>

> [@Willie\_Cadete](#):
>
> locale =\> "pt-BR"

Are your sure about this parameter, as your date seems to be english, you should prefer the `locale => "en"` config no?

---

<div class="post-metadata">

**Author:** ![Willie\_Cadete](https://avatars.discourse-cdn.com/v4/letter/w/ecd19e/32.png) [@Willie\_Cadete](https://discuss.elastic.co/u/Willie_Cadete)\
**Post date:** [March 16, 2016, 12:33pm UTC](https://discuss.elastic.co/t/failed-parsing-date-linux-syslog/44549/3 "2016-03-16T12:33:52Z")

</div>

I'd forgotten that, thank you! =D

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:06am UTC](https://discuss.elastic.co/t/failed-parsing-date-linux-syslog/44549/4 "2017-07-06T05:06:45Z")

</div>