# Getting \_dateparsefailure tag
**URL:** https://discuss.elastic.co/t/getting-dateparsefailure-tag/230375
**Category:** Logstash
**Created:** [April 29, 2020, 1:30pm UTC](https://discuss.elastic.co/t/getting-dateparsefailure-tag/230375 "2020-04-29T13:30:48Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Hari\_Krishna](https://discuss.elastic.co/u/Hari_Krishna)
#### Post date: [April 29, 2020, 1:30pm UTC](https://discuss.elastic.co/t/getting-dateparsefailure-tag/230375/1 "2020-04-29T13:30:48Z")
I have to replace the @timestamp in kibana with the timestamp in my log.But when i try to do that it doesn't replace, but it adds a \_dateparsefailure tag.
Here is my filter
```
filter {
grok
{
break_on_match => false
pattern_definitions => { "mssg" => "((Msg|message|Message|message1|message2|Message1|Message2) [=])"
"nhchg" => "%{WORD} -> %{WORD}"
"debug" => "NDP-DBG"
}
match => {
"message" => ["%{TIMESTAMP_ISO8601:timestamp} %{WORD:node}:%{WORD:program}:%{INT:pid} %{WORD:tracetype}.*%{mssg} \"%{GREEDYDATA:Message}\""]
"Message" => ["%{debug:NDPdebug}:%{DATA:function}:%{INT:line}:: %{GREEDYDATA:msg}", "NexthopId %{WORD:nexthop_id}", "state %{WORD:state}", "event %{WORD:event}", "Prefix %{DATA:prefix}/", "NhType_change %{nhchg:nhtype_change}"]
}
}
date {
match => ["timestamp","ISO8601","yyyy-MM-dd HH:mm:ss"]
target => "@timestamp"
}
}
```
Here is my log
`2020-04-28 16:47:43.663882033 re0:ndp:13273 lltp_debug message = "NDP-DBG:ndp_dad_stop:273:: ndp_dad_stop: DAD structure not found"`
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 29, 2020, 1:45pm UTC](https://discuss.elastic.co/t/getting-dateparsefailure-tag/230375/2 "2020-04-29T13:45:50Z")
It would not surprise me if that grok failed, but if it parses [timestamp] as 2020-04-28 16:47:43.663882033, with 9 digits of subsecond precision then you need a matching date filter
```
date { match => ["timestamp", "yyyy-MM-dd HH:mm:ss.SSSSSSSSS"] }
```
---
### Author:  [@Hari\_Krishna](https://discuss.elastic.co/u/Hari_Krishna)
#### Post date: [April 29, 2020, 2:00pm UTC](https://discuss.elastic.co/t/getting-dateparsefailure-tag/230375/3 "2020-04-29T14:00:30Z")
Hi Badger,
Now i dont see the error 🙂
But I see that the hour and minute seems to be different. Do i need to change any timezone?
And i also need the 9 digits of subseconds in @timestamp
```
@timestamp timestamp
Apr 17, 2020 @ 06:16:17.841 2020-04-17 11:46:17.841003766
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 29, 2020, 2:17pm UTC](https://discuss.elastic.co/t/getting-dateparsefailure-tag/230375/4 "2020-04-29T14:17:59Z")
> [@Hari\_Krishna](#):
>
> Do i need to change any timezone?
You can use the timezone option on the date filter to tell it what timezone your logs use. elasticsearch always stores dates as UTC. kibana will map it to the browser's timezone.
> [@Hari\_Krishna](#):
>
> And i also need the 9 digits of subseconds in @timestamp
Not going to happen. elasticsearch has a [date\_nanos](https://www.elastic.co/guide/en/elasticsearch/reference/current/date_nanos.html) type, but logstash has no support for anything beyond milliseconds.
---
### Author:  [@Hari\_Krishna](https://discuss.elastic.co/u/Hari_Krishna)
#### Post date: [April 29, 2020, 2:54pm UTC](https://discuss.elastic.co/t/getting-dateparsefailure-tag/230375/5 "2020-04-29T14:54:56Z")
Thanks. 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 27, 2020, 2:54pm UTC](https://discuss.elastic.co/t/getting-dateparsefailure-tag/230375/6 "2020-05-27T14:54:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.