# Filebeat timestamp processor parsing incorrectly

**URL:** <https://discuss.elastic.co/t/filebeat-timestamp-processor-parsing-incorrectly/246586>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 27, 2020, 9:05am UTC](https://discuss.elastic.co/t/filebeat-timestamp-processor-parsing-incorrectly/246586 "2020-08-27T09:05:09Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![anandd4](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anandd4/32/50610_2.png) [@anandd4](https://discuss.elastic.co/u/anandd4)\
**Post date:** [August 27, 2020, 9:05am UTC](https://discuss.elastic.co/t/filebeat-timestamp-processor-parsing-incorrectly/246586/1 "2020-08-27T09:05:09Z")

</div>

Filebeat timestamp processor is unable to parse timestamp as expected.

**Log file -**

```
26/Aug/2020:08:00:30 +0100
26/Aug/2020:08:02:30 +0100

```

**Filebeat config -**

```
  filebeat.inputs:
        - type: log
          paths:
            - /logs/tp1.log
        processors:
          - timestamp:
              field: message
              timezone: 'Europe/London'
              layouts:
                - '02/Jan/2006:15:04:05 +0100'
        	  test:
                - '26/Aug/2020:08:02:30 +0100'	  
        output.console:
          pretty: true

```

**Debug -**

```
`2020-08-27T09:54:56.185+0100 DEBUG [processor.timestamp] timestamp/timestamp.go:81 Test timestamp [26/Aug/2020:08:02:30 +0100] parsed as [2020-01-26 08:02:30 +0000 UTC]`

```

So as you see when timestamp processor tries to parse the datetime as per the defined layout, its not working as expected i.e.  
26/Aug/2020:08:02:30 +0100 is parsed as 2020- **01** -26 08:02:30 +0000 UTC

Note the month is changed from Aug to Jan by the timestamp processor which is not expected.

I don't know if this is a known issue but i can't get it working with the current date format and using a different date format is out of question as we are expecting date in the specified format from several sources.  
I would appreciate your help in find a solution to this problem.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [August 27, 2020, 10:33am UTC](https://discuss.elastic.co/t/filebeat-timestamp-processor-parsing-incorrectly/246586/2 "2020-08-27T10:33:17Z")

</div>

Hey @anandd4,

Interesting issue 🙂 I had to try some things with the Go date parser to understand it.

The thing here is that the Go date parser used by Beats uses numbers to identify what is what in the layout. Months are identified by the number 1. In string representation it is `Jan`, but in numeric representation it is `01`. In your layout you are using `01` to parse the timezone, that is `01` in your test date. `01` interpreted as a month is January, what explains the date you see. The rest of the timezone (`00`) is ignored because zero has no meaning in these layouts. Actually, if you look at the parsed date, the timezone is also incorrect. Timezones are parsed with the number 7, or `MST` in the string representation.

Summarizing, you need to use `-0700` to parse the timezone, so your layout needs to be `02/Jan/2006:15:04:05 -0700`.

Find here an example using Go directly: [https://play.golang.org/p/iNGqOQpCjhP](https://play.golang.org/p/iNGqOQpCjhP)

And you can read more about these layouts here: [https://golang.org/pkg/time/#pkg-constants](https://golang.org/pkg/time/#pkg-constants)

---

<div class="post-metadata">

**Author:** ![anandd4](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anandd4/32/50610_2.png) [@anandd4](https://discuss.elastic.co/u/anandd4)\
**Post date:** [August 27, 2020, 10:49am UTC](https://discuss.elastic.co/t/filebeat-timestamp-processor-parsing-incorrectly/246586/4 "2020-08-27T10:49:14Z")

</div>

Thanks @jsoriano for the explanation. I've actually tried that earlier but for some reason it didn't worked. I've tried it again & found it to be working fine though to parses the targeted timestamp field to UTC even when the timezone was given as BST.  
Its not a showstopper but would be good to understand the behaviour of the processor when timezone is explicitly provided in the config

`2020-08-27T09:40:09.358+0100 DEBUG [processor.timestamp] timestamp/timestamp.go:81 Test timestamp [26/Aug/2020:08:02:30 +0100] parsed as [2020-08-26 07:02:30 +0000 UTC].`

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [August 27, 2020, 11:02am UTC](https://discuss.elastic.co/t/filebeat-timestamp-processor-parsing-incorrectly/246586/5 "2020-08-27T11:02:31Z")

</div>

The timezone provided in the config is only used if the parsed timestamp doesn't contain timezone information. In your case the timestamps contain timezones, so you wouldn't need to provide it in the config.

Internally, this is implemented using this method: [https://golang.org/pkg/time/#ParseInLocation](https://golang.org/pkg/time/#ParseInLocation)

---

<div class="post-metadata">

**Author:** ![anandd4](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anandd4/32/50610_2.png) [@anandd4](https://discuss.elastic.co/u/anandd4)\
**Post date:** [August 27, 2020, 11:09am UTC](https://discuss.elastic.co/t/filebeat-timestamp-processor-parsing-incorrectly/246586/6 "2020-08-27T11:09:56Z")

</div>

Thanks for a prompt response.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 24, 2020, 1:10pm UTC](https://discuss.elastic.co/t/filebeat-timestamp-processor-parsing-incorrectly/246586/7 "2020-09-24T13:10:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.