# Grok parse failure - Replace timestamp

**URL:** https://discuss.elastic.co/t/grok-parse-failure-replace-timestamp/128488
**Category:** Logstash
**Created:** [April 18, 2018, 8:58am UTC](https://discuss.elastic.co/t/grok-parse-failure-replace-timestamp/128488 "2018-04-18T08:58:25Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![A.Klos](https://avatars.discourse-cdn.com/v4/letter/a/977dab/32.png) [@A.Klos](https://discuss.elastic.co/u/A.Klos)
#### Post date: [April 18, 2018, 8:58am UTC](https://discuss.elastic.co/t/grok-parse-failure-replace-timestamp/128488/1 "2018-04-18T08:58:25Z")

</div>

Hi,

I have following Json:

{  
"\_index": "filebeat-my-own-tag-xxx-2018.04.18",  
"\_type": "doc",  
"\_id": "saPh12IB-118Ln7atRDd",  
"\_version": 1,  
"\_score": null,  
"\_source": {  
"host": "hostname.my.domain",  
"source": "/WEB/apps/XXXx/yyyyy/logs/xxxx/logs/xxxx.log",  
"tags": [  
"my-own-tag-xxx",  
"beats\_input\_codec\_plain\_applied",  
"\_grokparsefailure",  
"\_dateparsefailure"  
],  
"@version": "1",  
"TIMEDATE": "%{Datum} %{Uhrzeit}",  
"message": "2018-04-18 10:18:18.254 INFO 9999 --- my message",  
"@timestamp": "2018-04-18T08:31:42.646Z",  
"offset": 192858,  
"prospector": {  
"type": "log"  
},  
"beat": {  
"name": "hostname.my.domain",  
"version": "6.2.2",  
"hostname": "hostname.my.domain"  
}  
},  
"fields": {  
"@timestamp": [  
"2018-04-18T08:31:42.646Z"  
]  
},  
"sort": [  
1524040302646  
]  
}

This is my filter:

if "my-own-tag-xxx" in [tags] {  
grok {  
match =\> ["message" , "%{DATE\_EU:Datum} (?[\d:\d:\d,\d]{12})" ]  
}  
mutate {  
add\_field =\> { "TIMEDATE" =\> "%{Datum} %{Uhrzeit}" }  
}  
date {  
match =\> ["TIMEDATE", "ISO8601", "dd.MM.yyyy HH:mm:ss','SSSS"]  
timezone =\> ["Europe/Berlin"]  
target =\> "@timestamp"  
}  
}  
}

I would replace timestamp with timestemp of message.

Whats wrong?

Regards

---

<div class="post-metadata">

### Author: ![A.Klos](https://avatars.discourse-cdn.com/v4/letter/a/977dab/32.png) [@A.Klos](https://discuss.elastic.co/u/A.Klos)
#### Post date: [April 24, 2018, 7:40am UTC](https://discuss.elastic.co/t/grok-parse-failure-replace-timestamp/128488/2 "2018-04-24T07:40:27Z")

</div>

Hi,

Problem fixed, using following filter now:

```
  grok {
      match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{GREEDYDATA:data}"}
  }
  date {
     match => ["timestamp", "ISO8601"]
     target => ["@timestamp"]
  }

```

Regards

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 22, 2018, 7:40am UTC](https://discuss.elastic.co/t/grok-parse-failure-replace-timestamp/128488/3 "2018-05-22T07:40:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.