# Grokparsefailure when I add a date filter

**URL:** <https://discuss.elastic.co/t/grokparsefailure-when-i-add-a-date-filter/197521>\
**Category:** Logstash\
**Created:** [August 30, 2019, 12:36pm UTC](https://discuss.elastic.co/t/grokparsefailure-when-i-add-a-date-filter/197521 "2019-08-30T12:36:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bquevat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bquevat/32/53368_2.png) [@bquevat](https://discuss.elastic.co/u/bquevat)\
**Post date:** [August 30, 2019, 12:36pm UTC](https://discuss.elastic.co/t/grokparsefailure-when-i-add-a-date-filter/197521/1 "2019-08-30T12:36:17Z")

</div>

Hello,

I'm encoutering a strange behaviour when using a date plugin.  
I have the following configuration:

> input {  
> file {  
> path =\> "/var/log/clients/tpxent06s/_"  
> type =\> "logs\_yoneos\_preprod"  
> exclude =\> "_.gz"  
> }  
> }
> 
> filter {  
> grok {  
> match =\> { "message" =\> "%{NOTSPACE:terminalId} %{NOTSPACE:date} %{NOTSPACE:time} %{NOTSPACE:file} %{DATA:application} %{NOTSPACE:word} %{INT:firstInt} %{INT:secondInt} NULL"}  
> }  
> mutate { gsub =\> ["time", ".\d{6}$", ""]}  
> mutate { add\_field =\> { "dateTime" =\> "%{date} %{time}" } }  
> date { match =\> ["dateTime", "yyyy-MM-dd"] }  
> }
> 
> output {  
> elasticsearch {  
> hosts =\> ["xx.xx.xxx.xx:9200"]  
> index =\> "tapandgo\_yoneo"  
> }  
> }

Sample data:

> 00071131 2019-08-11 22:10:26.668000 util.c TAP Buffer App openLog 1078 40 NULL [-1] [ERROR] [../src/manager/tapManager.c:435 TapManager\_SendTaps\_Callback] Unable to send the tap, we break the loop\n\n  
> 00071131 2019-08-11 22:10:26.721000 util.c TAP Buffer App openLog 1064 20 NULL [-1] [INFO] [../src/manager/bddManager.c:172 Database\_AddTapRejected] Tap Rejected has been added in database\n

The results is that all lines from my log files are tagged with grokparsefailure.  
If I comment the date plugin, my log lines are correctly parsed.

Do you have any ideao of what's going on?

Thanks.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 30, 2019, 1:13pm UTC](https://discuss.elastic.co/t/grokparsefailure-when-i-add-a-date-filter/197521/2 "2019-08-30T13:13:33Z")

</div>

Your data is tab separated. Is it possible that when you edit the configuration the editor is switching from space separated to tab separated?

---

<div class="post-metadata">

**Author:** ![bquevat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bquevat/32/53368_2.png) [@bquevat](https://discuss.elastic.co/u/bquevat)\
**Post date:** [August 30, 2019, 1:57pm UTC](https://discuss.elastic.co/t/grokparsefailure-when-i-add-a-date-filter/197521/3 "2019-08-30T13:57:26Z")

</div>

Hello Badger,

Thanks for your answer.  
I checked and tabs are OK after edition.  
If I only comment the date plugin, I go back to a situation where the log is correctly parsed.

---

<div class="post-metadata">

**Author:** ![bquevat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bquevat/32/53368_2.png) [@bquevat](https://discuss.elastic.co/u/bquevat)\
**Post date:** [September 2, 2019, 9:29am UTC](https://discuss.elastic.co/t/grokparsefailure-when-i-add-a-date-filter/197521/4 "2019-09-02T09:29:06Z")

</div>

Hello,

Problem solved.  
I am not sure of the exact cause but it seems it was solved by adding the correct encoding in the file in put plugin.

Benoît

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 30, 2019, 9:29am UTC](https://discuss.elastic.co/t/grokparsefailure-when-i-add-a-date-filter/197521/5 "2019-09-30T09:29:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.