# Filebeat works for sometime then stops working - fails to parse date

**URL:** <https://discuss.elastic.co/t/filebeat-works-for-sometime-then-stops-working-fails-to-parse-date/100931>\
**Category:** Elasticsearch\
**Created:** [September 18, 2017, 8:46pm UTC](https://discuss.elastic.co/t/filebeat-works-for-sometime-then-stops-working-fails-to-parse-date/100931 "2017-09-18T20:46:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mmugabo](https://avatars.discourse-cdn.com/v4/letter/m/f08c70/32.png) [@mmugabo](https://discuss.elastic.co/u/mmugabo)\
**Post date:** [September 18, 2017, 8:46pm UTC](https://discuss.elastic.co/t/filebeat-works-for-sometime-then-stops-working-fails-to-parse-date/100931/1 "2017-09-18T20:46:17Z")

</div>

Hello there at Elastic S. and Filebeat, any help here is appreciated.

I send app logs to elasticsearch using filebeat, this can work fine for weeks, then fails, saying "unable to parse date". My env is like this:

Filebeat: 5.3.1  
Elastic search: 5.5.1 (must be that version, but did not set up so am not sure 100%, but I know it is 5.x)  
Kibana: 5.51 (must be that version too).

Note that simulation API for the pipeline and the messages from the logs works fine, and as mentioned, even file beat pushes the files for some weeks, all of a sudden it starts failing, nothing goes in the ES.

The errors I get are like this:

++++++++++++++++++  
**2017-09-18T16:27:41-04:00 INFO Bulk item insert failed (i=1, status=500): {"type":"exception","reason":"java.lang.IllegalArgumentException: java.lang.IllegalArgumentException: unable to parse date [2017-09-18T20:27:22.357Z]","caused\_by":{"type":"illegal\_argument\_exception","reason":"java.lang.IllegalArgumentException: unable to parse date [2017-09-18T20:27:22.357Z]","caused\_by":{"type":"illegal\_argument\_exception","reason":"unable to parse date [2017-09-18T20:27:22.357Z]","caused\_by":{"type":"illegal\_argument\_exception","reason":"Invalid format: "2017-09-18T20:27:22.357Z" is malformed at "17-09-18T20:27:22.357Z""}}},"header":{"processor\_type":"date"}}**  
++++++++++++++++++

My pipeline looks like:

"processors": [  
{  
"gsub": {  
"field": "message",  
"pattern": "\n",  
"replacement": "\\n"  
}  
},  
{  
"grok": {  
"field": "message",  
"patterns": [  
"%{IPORHOST:log.clientip} %{USER:log.ident} %{USER:log.auth} %{HTTPDATE:log.rawdatetime} "(?:%{WORD:log.verb} %{NOTSPACE:log.request}(?: HTTP/%{NUMBER:log.httpversion})?|%{DATA:log.rawrequest})" %{NUMBER:log.response} (?:%{NUMBER:log.bytes}|-)",  
"%{AEM\_DATE\_FORMAT:log.datetime} %{DATA:log.level} %{DATA:log.module} %{GREEDYDATA:log.message}"  
],  
"pattern\_definitions": {  
"AEM\_DATE\_FORMAT": "%{DATE\_EU} %{TIME}"  
},  
"on\_failure": [  
{  
"set": {  
"field": "ingestError",  
"value": "{{ \_ingest.on\_failure\_message }}"  
}  
},  
{  
"set": {  
"field": "log.datetime",  
"value": "{{ @timestamp }}"  
}  
}  
]  
}  
},  
{  
"date": {  
"field": "log.datetime",  
"target\_field": "log.datetime",  
"formats": [  
"dd.MM.yyyy HH:mm:ss.SSS"  
],  
"timezone": "America/New\_York"  
}  
}  
]

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 16, 2017, 8:46pm UTC](https://discuss.elastic.co/t/filebeat-works-for-sometime-then-stops-working-fails-to-parse-date/100931/2 "2017-10-16T20:46:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.