# Having problem to load a text file that contain DATE fields using logstash

**URL:** <https://discuss.elastic.co/t/having-problem-to-load-a-text-file-that-contain-date-fields-using-logstash/63668>\
**Category:** Logstash\
**Created:** [October 22, 2016, 7:10pm UTC](https://discuss.elastic.co/t/having-problem-to-load-a-text-file-that-contain-date-fields-using-logstash/63668 "2016-10-22T19:10:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![yoavb](https://avatars.discourse-cdn.com/v4/letter/y/839c29/32.png) [@yoavb](https://discuss.elastic.co/u/yoavb)\
**Post date:** [October 22, 2016, 7:10pm UTC](https://discuss.elastic.co/t/having-problem-to-load-a-text-file-that-contain-date-fields-using-logstash/63668/1 "2016-10-22T19:10:04Z")

</div>

Hi,

I am totaly new to the ELK world.  
I have tried to load a text file that contain several date fields using logstash.  
I have tried to configure the field START\_DATE and END\_DATE to use the following format : DD/MM/YYYY HH:MM:SS

Config file look like

input {  
file {  
path =\> "/tmp/radius\_p2016\*.txt"  
type =\> "radius\_log\_test"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}  
}

filter {  
csv {  
columns =\> ["USERNAME","ACCT\_SESSION","IP",START\_DATE,END\_DATE,.........,"TERM\_CODE"]  
separator =\> ","  
}

```
date {
      match => ["END_DATE", "DD/MM/YYYY HH:MM:SS"]
      target => "END_DATE"
     }
     
date {
      match => ["START_DATE", "DD/MM/YYYY HH:MM:SS"]
      target => "START_DATE"
     }

```

}

output {  
elasticsearch {  
action =\> "index"  
hosts =\> ["localhost:9200"]  
index =\> "radius-test"  
}

stdout {  
codec =\> rubydebug  
}  
}

And the error message looks like

Failed parsing date from field {:field=\>"START\_DATE", :value=\>"18/10/2016 01:20:49", :exception=\>"Cannot parse "18/10/2016 01:20:49": Value 20 for monthOfYear must be in the range [1,12]", :config\_parsers=\>"DD/MM/YYYY HH:MM:SS", :config\_locale=\>"default=en\_US", :level=\>:warn}  
Failed parsing date from field {:field=\>"END\_DATE", :value=\>"18/10/2016 01:23:21", :exception=\>"Cannot parse "18/10/2016 01:23:21": Value 23 for monthOfYear must be in the range [1,12]", :config\_parsers=\>"DD/MM/YYYY HH:MM:SS", :config\_locale=\>"default=en\_US", :level=\>:warn}  
.....  
Failed action. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"radius-test", :\_type=\>"radius\_log\_test", :\_routing=\>nil},  
#\<LogStash::Event:0x54aba0ac @metadata={"path"=\>"/tmp/radius\_p20161018\_2.txt"},  
@accessors=#\<LogStash::Util::Accessors:0x32e463ef  
@store={"message"=\>"0355349081,JJJ10JJJJJ58024A03-58054574,1337101124,18/10/2016 01:23:21,18/10/2016 04:41:09,7750-XXXX-XX8097 lag-171:349.90,,3558425636,XXXX,150019,Start,3568549330,2481677921,int9,RB-9,Iint,0,0,100000,,,1476740469,RADIUS,,,,PPP,Framed-User,31949774396,0\r", "@version"=\>"1", "@timestamp"=\>"2016-10-22T18:57:39.150Z"  
.....

Please advise

Regards

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 25, 2016, 5:49am UTC](https://discuss.elastic.co/t/having-problem-to-load-a-text-file-that-contain-date-fields-using-logstash/63668/2 "2016-10-25T05:49:10Z")

</div>

> ```
> match => ["END_DATE", "DD/MM/YYYY HH:MM:SS"]
> 
> ```

"MM" can't mean both month and minute. Have a look at [DateTimeFormat (Joda time 2.2 API)](http://joda-time.sourceforge.net/apidocs/org/joda/time/format/DateTimeFormat.html) for a table of available format tokens.

---

<div class="post-metadata">

**Author:** ![yoavb](https://avatars.discourse-cdn.com/v4/letter/y/839c29/32.png) [@yoavb](https://discuss.elastic.co/u/yoavb)\
**Post date:** [October 28, 2016, 9:37am UTC](https://discuss.elastic.co/t/having-problem-to-load-a-text-file-that-contain-date-fields-using-logstash/63668/3 "2016-10-28T09:37:09Z")

</div>

Hi magnusbaeck ,

Thanks for your previous feedback.

It seems that i am missing here somthing.

You said that : "MM cant mean both month and minute"

As you can see bellow i have changed the format from : DD/MM/YYYY HH:MM:SS to  
dd-mm-yyyy hh:mi:ss and there is not problem with the format.  
How do you explain that ?

Regards

[elastic@ptktl-elk ~]$ curl -XPUT "[http://localhost:9200/yoavmyindex3](http://localhost:9200/yoavmyindex3)" -d'

> {  
> "mappings": {  
> "my\_type": {  
> "properties": {  
> "start\_date": {  
> "type": "date",  
> "format": "dd-MM-yyyy HH:mm:ss"  
> }  
> }  
> }  
> }  
> }
> 
> '  
> {"acknowledged":true}[elastic@ptktl-elk ~]$  
> [elastic@ptktl-elk ~]$  
> [elastic@ptktl-elk ~]$ curl -XGET '[http://localhost:9200/yoavmyindex3/\_mapping?pretty](http://localhost:9200/yoavmyindex3/_mapping?pretty)'  
> {  
> "yoavmyindex3" : {  
> "mappings" : {  
> "my\_type" : {  
> "properties" : {  
> "start\_date" : {  
> "type" : "date",  
> "format" : "dd-MM-yyyy HH:mm:ss"  
> }  
> }  
> }  
> }  
> }  
> }  
> [elastic@ptktl-elk ~]$

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 28, 2016, 11:09am UTC](https://discuss.elastic.co/t/having-problem-to-load-a-text-file-that-contain-date-fields-using-logstash/63668/4 "2016-10-28T11:09:04Z")

</div>

I'm talking about your date filter, not your mappings. Your date pattern "DD/MM/YYYY HH:MM:SS" is wrong because you have "MM", which means month, in two places. "DD" and "SS" is also wrong.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:32am UTC](https://discuss.elastic.co/t/having-problem-to-load-a-text-file-that-contain-date-fields-using-logstash/63668/5 "2017-07-06T04:32:11Z")

</div>

Closed on July 6, 2017, 4:32am UTC