# Failed to parse \[date\]
**URL:** https://discuss.elastic.co/t/failed-to-parse-date/130563
**Category:** Logstash
**Created:** [May 4, 2018, 5:27am UTC](https://discuss.elastic.co/t/failed-to-parse-date/130563 "2018-05-04T05:27:41Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@lcguy](https://discuss.elastic.co/u/lcguy)
#### Post date: [May 4, 2018, 5:27am UTC](https://discuss.elastic.co/t/failed-to-parse-date/130563/1 "2018-05-04T05:27:41Z")
I hope someone can guide me as for date parsing.
Logstash config has below date format.
date {
match =\> ["@date", "yyyy-MM-dd HH:mm:ss Z"]
}
But, I am getting below error...
"status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [date]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Invalid format: "2018-05-04 03:55:30 +0000" is malformed at " 03:55:30 +0000""}}}}}
When I run manually, I received the output as below.
```
"date" => "2018-05-04 03:55:30 +0000",
"bytes_written_to_client" => "4933",
"srcip" => "x.x.x.x",
"dstport" => "443",
"bytes_written_to_server" => "3303",
"pid" => "18895",
"type" => "t_nettraffic",
"hostname" => "FIREWALLONE",
"host" => "10.10.10.10",
"devname" => "FIREWALL1",
"dstip" => "x.x.x.x",
"event" => "session end",
"rule_name" => "TEST RULE",
"pri" => "p_major",
"priority" => "45",
"dst_geo" => "XX",
"srczone" => "VL_SOURCE",
"start_time" => "2018-05-04 03:54:25 +0000",
"@timestamp" => 2018-05-04T03:55:30.167Z,
"application" => "TCP 443",
"proto" => "6",
"srcport" => "57878",
"dstzone" => "VLEXT",
"logid" => "0",
"cmd" => "httpp"
```
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 4, 2018, 5:43am UTC](https://discuss.elastic.co/t/failed-to-parse-date/130563/2 "2018-05-04T05:43:49Z")
It looks like your field is named `date` and not `@date`, which is what you have specified in the date filter.
---
### Author:  [@lcguy](https://discuss.elastic.co/u/lcguy)
#### Post date: [May 4, 2018, 5:51am UTC](https://discuss.elastic.co/t/failed-to-parse-date/130563/3 "2018-05-04T05:51:20Z")
Sorry, my typo.
Correct one don't have @ sign.
date {
match =\> ["date", "yyyy-MM-dd HH:mm:ss Z"]
}
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 4, 2018, 5:57am UTC](https://discuss.elastic.co/t/failed-to-parse-date/130563/4 "2018-05-04T05:57:31Z")
This works for me:
```auto
input {
generator {
lines => ['2018-05-04 03:55:30 +0000']
count => 1
}
}
filter {
date {
match => ["message", "yyyy-MM-dd HH:mm:ss Z"]
}
}
output {
stdout { codec => rubydebug }
}
```
---
### Author:  [@lcguy](https://discuss.elastic.co/u/lcguy)
#### Post date: [May 4, 2018, 6:15am UTC](https://discuss.elastic.co/t/failed-to-parse-date/130563/5 "2018-05-04T06:15:36Z")
Thanks, but it is still getting error as below. But, when I execute logstash, I am still getting like your output.
Elasticsearch is not showing log from this firewall.
[2018-05-04T14:11:05,745][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"logstash-2018.05.04", :\_type=\>"t\_nettraffic", :\_routing=\>nil}, 2018-05-04T06:11:05.000Z x.x.x.x %{message}], :response=\>{"index"=\>{"\_index"=\>"logstash-2018.05.04", "\_type"=\>"t\_nettraffic", "\_id"=\>"AsdfwesxxERDSFWExxrfwere", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [date]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Invalid format: "2018-05-04 06:11:05 +0000" is malformed at " 06:11:05 +0000""}}}}}
---
### Author:  [@lcguy](https://discuss.elastic.co/u/lcguy)
#### Post date: [May 5, 2018, 10:26am UTC](https://discuss.elastic.co/t/failed-to-parse-date/130563/6 "2018-05-05T10:26:53Z")
@Christian_Dahlqvist ...Thanks.
Finally solved it.
I just added remove\_field =\> ["date"].
Here is completed one.
date {
match =\> ["date", "yyyy-MM-dd HH:mm:ss Z"]
remove\_field =\> ["date"]
}
}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 2, 2018, 10:26am UTC](https://discuss.elastic.co/t/failed-to-parse-date/130563/7 "2018-06-02T10:26:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.