# Help parsing \[06/Sep/2017:10:57:42 -0400\]

**URL:** <https://discuss.elastic.co/t/help-parsing-06-sep-2017-10-57-42-0400/99622>\
**Category:** Logstash\
**Created:** [September 6, 2017, 6:17pm UTC](https://discuss.elastic.co/t/help-parsing-06-sep-2017-10-57-42-0400/99622 "2017-09-06T18:17:16Z")\
**Posts on this page:** 5\
**Page:** 2

<div class="post-metadata">

**Author:** ![cchooks2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cchooks2/32/21987_2.png) [@cchooks2](https://discuss.elastic.co/u/cchooks2)\
**Post date:** [September 12, 2017, 12:20am UTC](https://discuss.elastic.co/t/help-parsing-06-sep-2017-10-57-42-0400/99622/21 "2017-09-12T00:20:48Z")

</div>

I did a "last 24 hours" i was able to locate some chunks of data with no dateparsefailure, but just that showing up in the past as oppose to current. The access logs are being written in EST and are continuously coming in.

> [@theuntergeek](#):
>
> Also, what is the timezone of the machine you're on?

(UTC-06:00) Central Time (US & Canada)

Thanks

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [September 12, 2017, 2:15pm UTC](https://discuss.elastic.co/t/help-parsing-06-sep-2017-10-57-42-0400/99622/22 "2017-09-12T14:15:26Z")

</div>

Can you please paste the JSON from one of these entries as you see it in the Discover pane? You say that the logs are being written in EST. They should be written in Zulu notation. I would like to see the expanded JSON. Please include it as text or a screenshot, if necessary.

---

<div class="post-metadata">

**Author:** ![cchooks2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cchooks2/32/21987_2.png) [@cchooks2](https://discuss.elastic.co/u/cchooks2)\
**Post date:** [September 12, 2017, 6:40pm UTC](https://discuss.elastic.co/t/help-parsing-06-sep-2017-10-57-42-0400/99622/23 "2017-09-12T18:40:33Z")

</div>

No dateparsefailure, but shows up in the past as oppose to current.

 ![working](https://us1.discourse-cdn.com/elastic/original/3X/3/1/31492bbbb437754ed2d8acc42dd7e306cc284e6e.PNG)

Dateparsefailure tag from today's data. Date plugin : match =\> ["event\_timestamp" ,"dd/MMM/yyyy:HH:mm:ss"]. Have it like this because we still need to see the data coming in.

 ![dateparsefailure](https://us1.discourse-cdn.com/elastic/original/3X/1/0/100cd806546c095107cb2cb8edbb4e6591b5f5c4.PNG)

Thanks

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [September 12, 2017, 7:10pm UTC](https://discuss.elastic.co/t/help-parsing-06-sep-2017-10-57-42-0400/99622/24 "2017-09-12T19:10:36Z")

</div>

But it's clear that it's doing exactly what it should be doing. In the top example, I see:

```auto
"event_timestamp": "11/Sep/2017:12:15:08 -0400"

```

And in the same event:

```auto
"@timestamp": "2017-09-11T16:15:08.000Z"

```

This is exactly correct. The `date` filter has done what it was supposed to be doing. This is `event_timestamp` accurately re-configured to be in UTC. Clearly, the problem is not in Logstash, or in Elasticsearch. Both are doing exactly what they should be doing, and you've just uploaded the proof.

**_However..._**

When I look at the second example, where you have disabled the `date` filter and are using the `@timestamp` that Logstash generates for each event at ingest time, I see:

```auto
"event_timestamp": "12/Sep/2017:11:31:53 -0400"

```

And in the same event:

```auto
"@timestamp": "2017-09-12T18:22:33.672Z"

```

**This is a nearly 7 hour offset.** Even accounting for a 49 minute delay in ingestion—representing an offset of 6 hours—this is a huge discrepancy.

The problem could be that you're sending data, but its taking a very long time to process a backlog, so you're just not seeing the real-time data you want, due to the processing delay. This seems probable based on the data you've shared.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 10, 2017, 7:10pm UTC](https://discuss.elastic.co/t/help-parsing-06-sep-2017-10-57-42-0400/99622/25 "2017-10-10T19:10:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/help-parsing-06-sep-2017-10-57-42-0400/99622.md?page=1)