# Filebeat 7.17.0 - Unable to parse time field "Jun 21 09:16:38" with \[Stamp\]

**URL:** https://discuss.elastic.co/t/filebeat-7-17-0-unable-to-parse-time-field-jun-21-0938-with-stamp/336703
**Category:** Beats
**Tags:** filebeat
**Created:** [June 22, 2023, 1:41pm UTC](https://discuss.elastic.co/t/filebeat-7-17-0-unable-to-parse-time-field-jun-21-0938-with-stamp/336703 "2023-06-22T13:41:01Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![vavaux](https://avatars.discourse-cdn.com/v4/letter/v/71c47a/32.png) [@vavaux](https://discuss.elastic.co/u/vavaux)
#### Post date: [June 22, 2023, 1:41pm UTC](https://discuss.elastic.co/t/filebeat-7-17-0-unable-to-parse-time-field-jun-21-0938-with-stamp/336703/1 "2023-06-22T13:41:01Z")

</div>

Hello,

Quite newbie on ELK & Filebeat (using v7.17.0), I'm trying to parse and retrieve the log line date as timestamp from following logs:

`Jun 19 22:08:00: WARNING: RCP timeout when waiting for ping response. Disconnecting Connection(S,/172.28.9.191:54284 <RCP /172.28.9.191:35887>)`

With my current implementation, filebeat returns the following error:

```auto
2023-06-22T15:04:52.952+0200 ERROR instance/beat.go:1015 Exiting: Failed to start crawler: starting input failed: Error while initializing input: failed parsing time field log_time='Jun 21 09:16:38': failed using layout [Stamp] cannot parse [Jun 21 09:16:38] as [Stamp]
failed to parse test timestamp

```

I used following filebeat configuration as per the information about Go timestamp I could find:

```auto
  processors:
    - dissect:
        tokenizer: '(?<log_time>%{MONTH} %{MONTHDAY} %{TIME}): %{GREEDYDATA:log}'
        field: "message"
        target_prefix: ""
    - timestamp:
        field: log_time
        layouts:
          - Stamp
        test:
          - 'Jun 21 09:16:38'
    - drop_fields:
        fields: [log_time]

```

Can you help me understandinh what's wrong ?

Many thanks in advance.

NOTE: I also tried using "stamp" (without capital letter) to verify it was not a case issue but not working as well

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 20, 2023, 3:41pm UTC](https://discuss.elastic.co/t/filebeat-7-17-0-unable-to-parse-time-field-jun-21-0938-with-stamp/336703/2 "2023-07-20T15:41:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.