# Filebeat syslog module problem on year change
**URL:** https://discuss.elastic.co/t/filebeat-syslog-module-problem-on-year-change/71114
**Category:** Elasticsearch
**Created:** [January 10, 2017, 4:01pm UTC](https://discuss.elastic.co/t/filebeat-syslog-module-problem-on-year-change/71114 "2017-01-10T16:01:41Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@pprkut](https://discuss.elastic.co/u/pprkut)
#### Post date: [January 10, 2017, 4:01pm UTC](https://discuss.elastic.co/t/filebeat-syslog-module-problem-on-year-change/71114/1 "2017-01-10T16:01:41Z")
I configured filebeat to import data from /var/log/secure into elasticsearch using the new module data available in the git repo. See [here](https://github.com/elastic/beats/blob/master/filebeat/module/syslog/system/ingest/pipeline.json) for the pipeline config I used. This worked great until new year's day when I started to see parsed entries like these:
```
{
"_index": "filebeat-2017.01.02",
"_type": "secure",
"_id": "AVlhaS3Vpt2V0zqfCLFb",
"_score": null,
"_source": {
"@timestamp": "2016-01-02T23:59:48.000Z",
"offset": 281345,
"beat": {
"hostname": "freud.ahti.mobi",
"name": "freud.ahti.mobi",
"version": "5.1.1"
},
"input_type": "log",
"source": "/var/log/secure",
"syslog": {
"system": {
"hostname": "freud",
"pid": "8397",
"program": "sshd",
"message": "Connection closed by 172.31.25.147 [preauth]",
"timestamp": "Jan 2 23:59:48"
}
},
"fields": {
"pipeline": "syslog",
"environment": "extra",
"role": "influxdb",
"source_type": "syslog-system"
},
"type": "secure"
},
"fields": {
"@timestamp": [
1451779188000
]
},
"highlight": {
"syslog.system.program": [
"@kibana-highlighted-field@sshd@/kibana-highlighted-field@"
]
},
"sort": [
1451779188000
]
}
```
Note that the date string "Jan 2 23:59:48" was parsed as "2016-01-02T23:59:48.000Z", which is a whole year off. I _think_ this indicates a bug in the date processor, but not entirely sure. A restart of elasticsearch "fixed" it for new entries.
---
### Author:  [@jakommo](https://discuss.elastic.co/u/jakommo)
#### Post date: [January 10, 2017, 4:23pm UTC](https://discuss.elastic.co/t/filebeat-syslog-module-problem-on-year-change/71114/2 "2017-01-10T16:23:26Z")
Hi @pprkut,
this looks like a bug too me, similar issue happend in Logstash a while back [https://github.com/logstash-plugins/logstash-filter-date/issues/3](https://github.com/logstash-plugins/logstash-filter-date/issues/3).
IMO the real problem is that syslog does not include a Year by default, but the ingest node should handle this on year switch over.
Would you mind creating an issue at [https://github.com/elastic/elasticsearch/issues](https://github.com/elastic/elasticsearch/issues) ?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 7, 2017, 4:23pm UTC](https://discuss.elastic.co/t/filebeat-syslog-module-problem-on-year-change/71114/3 "2017-02-07T16:23:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.