# Getting \_dateparsefailure

**URL:** <https://discuss.elastic.co/t/getting--dateparsefailure/89986>\
**Category:** Logstash\
**Created:** [June 19, 2017, 7:46pm UTC](https://discuss.elastic.co/t/getting--dateparsefailure/89986 "2017-06-19T19:46:25Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Amit2015](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Amit2015](https://discuss.elastic.co/u/Amit2015)\
**Post date:** [June 19, 2017, 7:46pm UTC](https://discuss.elastic.co/t/getting--dateparsefailure/89986/1 "2017-06-19T19:46:25Z")

</div>

Hi,

I have date format like 20170616155531767-0500 which is unable to parse. Can you give me solution how can I parse date. I used date filter :

date {  
locale =\> "en"  
match =\> ["REQUEST\_TIMESTAMP", "yyyyMMddHHmmssSSSZ"]  
}

Thanks!

---

<div class="post-metadata">

**Author:** ![Amit2015](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Amit2015](https://discuss.elastic.co/u/Amit2015)\
**Post date:** [June 19, 2017, 8:46pm UTC](https://discuss.elastic.co/t/getting--dateparsefailure/89986/2 "2017-06-19T20:46:23Z")

</div>

I tried yyyyMMddHHmmssSSS-Z also but getting same -dateparsefailure.

also tried,

date {  
#locale =\> "en"  
match =\> ["REQUEST\_TIMESTAMP", "yyyyMMddHHmmssSSS-Z", "ISO8601"]

```
    }

```

date {  
#locale =\> "en"  
match =\> ["REQUEST\_TIMESTAMP", "yyyyMMddHHmmssSSS-Z"]

```
    }
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 19, 2017, 9:01pm UTC](https://discuss.elastic.co/t/getting--dateparsefailure/89986/3 "2017-06-19T21:01:37Z")

</div>

The date filter will log details about its failure so I suggest you look in the Logstash's log file for clues.

---

<div class="post-metadata">

**Author:** ![Amit2015](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Amit2015](https://discuss.elastic.co/u/Amit2015)\
**Post date:** [June 19, 2017, 11:40pm UTC](https://discuss.elastic.co/t/getting--dateparsefailure/89986/4 "2017-06-19T23:40:09Z")

</div>

Hi,

Thanks for reply.

Its giving REQUEST\_TIMESTAMP as string not as date. Not getting any error also.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 20, 2017, 5:47am UTC](https://discuss.elastic.co/t/getting--dateparsefailure/89986/5 "2017-06-20T05:47:16Z")

</div>

Works fine here:

```plaintext
$ cat date.config 
input { stdin { } }
output { stdout { codec => rubydebug } }
filter {
  date {
    match => [
      "message",
      "yyyyMMddHHmmssSSSZ"
    ]
  }
}
$ echo '20170616155531767-0500' | /opt/logstash/bin/logstash -f date.config
Settings: Default pipeline workers: 8
Pipeline main started
{
       "message" => "20170616155531767-0500",
      "@version" => "1",
    "@timestamp" => "2017-06-16T20:55:31.767Z",
          "host" => "lnxolofon"
}
Pipeline main has been shutdown
stopping pipeline {:id=>"main"}

```

> Its giving REQUEST\_TIMESTAMP as string not as date.

What do you mean?

> Not getting any error also.

I find it very hard to believe that a date filter that adds `_dateparsefailure` doesn't log anything about what caused the error.

---

<div class="post-metadata">

**Author:** ![Amit2015](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Amit2015](https://discuss.elastic.co/u/Amit2015)\
**Post date:** [June 20, 2017, 5:19pm UTC](https://discuss.elastic.co/t/getting--dateparsefailure/89986/6 "2017-06-20T17:19:28Z")

</div>

Hi Magnusbaeck,

I written date filter as you suggested:

date {  
#locale =\> "en"  
match =\> ["REQUEST\_TIMESTAMP", "yyyyMMddHHmmssSSSZ"]  
}

But REQUEST\_TIMESTAMP getting as string not as date. I am able to ingest logs into ES but getting REQUEST\_TIMESTAMP as String, I want it in date.

This is my configfile:

input {  
file {  
path =\> ["/abc/xyz.csv"]  
start\_position =\> "beginning"  
type =\> "elastic"  
sincedb\_path =\> "/dev/null"  
ignore\_older =\> 0  
}

}  
filter {  
csv {  
separator =\> ","

columns =\> ["abc","assd","REQUEST\_TIMESTAMP","RESPONSE\_TIMESTAMP"]

```
    skip_empty_columns => true
    quote_char => "$"

```

}

```
     date {
                         match => ["REQUEST_TIMESTAMP", "yyyyMMddHHmmssSSSZ"]
                  }

    date {
                          match => ["RESPONSE_TIMESTAMP", "yyyyMMddHHmmssSSSZ"]
          
          

    }

```

}  
output {  
elasticsearch {  
hosts =\> ["ip"]  
index =\> "xxx-%{+[YYYY.MM](http://YYYY.MM)}"  
}

```
    stdout { codec => rubydebug }

```

}

---

<div class="post-metadata">

**Author:** ![Amit2015](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Amit2015](https://discuss.elastic.co/u/Amit2015)\
**Post date:** [June 20, 2017, 7:17pm UTC](https://discuss.elastic.co/t/getting--dateparsefailure/89986/7 "2017-06-20T19:17:08Z")

</div>

I tried same:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/c/a/caf7fc2543d18f311419e42695b01bced91ab624.JPG) ![](https://us1.discourse-cdn.com/elastic/original/3X/4/e/4e575b3879be297f7b3498a98854040727897890.JPG)

Please help...  
Thanks!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 21, 2017, 5:28am UTC](https://discuss.elastic.co/t/getting--dateparsefailure/89986/8 "2017-06-21T05:28:21Z")

</div>

As your example shows the date filter is working just fine. Please don't post screenshots. Use copy/paste.

Unless configured otherwise the date filter writes the parsed timestamp to the `@timestamp` field. If you want it stored elsewhere you have to adjust the `target` option.

Secondly, because the mapping of a field can't be modified you'll have to wait until the next index is created (typically the next day) or you can delete the current index so that it's recreated.

---

<div class="post-metadata">

**Author:** ![Amit2015](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Amit2015](https://discuss.elastic.co/u/Amit2015)\
**Post date:** [June 21, 2017, 8:29pm UTC](https://discuss.elastic.co/t/getting--dateparsefailure/89986/10 "2017-06-21T20:29:06Z")

</div>

Thanks a lot, It works for me.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 19, 2017, 8:29pm UTC](https://discuss.elastic.co/t/getting--dateparsefailure/89986/11 "2017-07-19T20:29:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.