# Failed to parse a date field in Logstash

**URL:** <https://discuss.elastic.co/t/failed-to-parse-a-date-field-in-logstash/288008>\
**Category:** Logstash\
**Created:** [October 29, 2021, 1:57pm UTC](https://discuss.elastic.co/t/failed-to-parse-a-date-field-in-logstash/288008 "2021-10-29T13:57:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dedi27](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dedi27/32/77118_2.png) [@dedi27](https://discuss.elastic.co/u/dedi27)\
**Post date:** [October 29, 2021, 1:57pm UTC](https://discuss.elastic.co/t/failed-to-parse-a-date-field-in-logstash/288008/1 "2021-10-29T13:57:08Z")

</div>

Fail to parse a date field in Logstash

Hello,  
I'm trying to parse a date field from a log file coming from an Exim Mail Server where I have a date string like this "2021-10-28 15:44:40".  
In my filter in Logstash, first I apply a "mutate" filter and add a timezone where the date field looks like this "2021-10-28 15:44:40 -0300"  
But when a trying to parse date format, I got the error below.  
My question is how I can do this?  
My setup is this.

 ![Screenshot_7](https://us1.discourse-cdn.com/elastic/original/3X/0/0/00260673ec9c1e1759acd4f4286469800fe83af1.png)

The index mapping is this.

 ![InkedScreenshot_6_LI](https://us1.discourse-cdn.com/elastic/original/3X/3/5/359d4fbb23992b36c75df272ce675e16b4507473.jpeg)

And the error I getting is this.

 ![Screenshot_5](https://us1.discourse-cdn.com/elastic/original/3X/7/4/7401eec9febfb5cf4cd5c05fd503ea4fae71076c.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 29, 2021, 2:03pm UTC](https://discuss.elastic.co/t/failed-to-parse-a-date-field-in-logstash/288008/2 "2021-10-29T14:03:55Z")

</div>

In logstash, unlike Elasticsearch or kibana, the syntax to reference a nested field in an object is "[exim4][datetime]", not "exim4.datetime".

---

<div class="post-metadata">

**Author:** ![dedi27](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dedi27/32/77118_2.png) [@dedi27](https://discuss.elastic.co/u/dedi27)\
**Post date:** [October 29, 2021, 2:36pm UTC](https://discuss.elastic.co/t/failed-to-parse-a-date-field-in-logstash/288008/3 "2021-10-29T14:36:00Z")

</div>

I fixed this by editing my index template and adjusting the date field format in Kibana as below.

 ![Screenshot_11](https://us1.discourse-cdn.com/elastic/original/3X/8/7/8792cd2907caae7fa06706382d875c0d01e9f6ce.png)

 ![Screenshot_8](https://us1.discourse-cdn.com/elastic/original/3X/9/a/9ae65ffe97674d4979b0403e757da84e74489d03.png)

It's working now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 26, 2021, 2:36pm UTC](https://discuss.elastic.co/t/failed-to-parse-a-date-field-in-logstash/288008/4 "2021-11-26T14:36:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.