# Help with match date 2019-12-04 06:34:33.850000+00:00 **URL:** \ **Category:** Logstash\ **Created:** [December 9, 2019, 3:34pm UTC](https://discuss.elastic.co/t/help-with-match-date-2019-12-04-0633-850000-00-00/211152 "2019-12-09T15:34:39Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![LLhborda](https://avatars.discourse-cdn.com/v4/letter/l/a8b319/32.png) [@LLhborda](https://discuss.elastic.co/u/LLhborda)\ **Post date:** [December 9, 2019, 3:34pm UTC](https://discuss.elastic.co/t/help-with-match-date-2019-12-04-0633-850000-00-00/211152/1 "2019-12-09T15:34:39Z")
I have date values like this 2019-12-04 06:34:33.850000+00:00 I have trouble describing the format on "match". So far the closet I came up is "yyyy-mm-dd hh:mm:ss.sss" should I use: timezone =\> GMT locale - en-us Thanks in advance ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [December 9, 2019, 3:59pm UTC](https://discuss.elastic.co/t/help-with-match-date-2019-12-04-0633-850000-00-00/211152/2 "2019-12-09T15:59:14Z")
I think "yyyy-MM-dd HH:mm:ss.SSSSSSZ" would work. No need to specify a timezone since it is included in the date. ---
**Author:** ![LLhborda](https://avatars.discourse-cdn.com/v4/letter/l/a8b319/32.png) [@LLhborda](https://discuss.elastic.co/u/LLhborda)\ **Post date:** [December 9, 2019, 6:39pm UTC](https://discuss.elastic.co/t/help-with-match-date-2019-12-04-0633-850000-00-00/211152/3 "2019-12-09T18:39:29Z")
Badger, thanks a lot for the quick response. I works for almost 90% of the cases but for example for '2019-10-19 18:59:17.212000+00:00' throws "illegal\_argument\_exception" failed to parse date field with format [strict\_date\_optional\_time || epoch\_millis] Do you have any ideas? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [December 9, 2019, 10:50pm UTC](https://discuss.elastic.co/t/help-with-match-date-2019-12-04-0633-850000-00-00/211152/4 "2019-12-09T22:50:39Z")
logstash throws an exception? Or logstash gets a 400 from elasticsearch and elasticsearch throws the exception? ---
**Author:** ![LLhborda](https://avatars.discourse-cdn.com/v4/letter/l/a8b319/32.png) [@LLhborda](https://discuss.elastic.co/u/LLhborda)\ **Post date:** [December 9, 2019, 11:15pm UTC](https://discuss.elastic.co/t/help-with-match-date-2019-12-04-0633-850000-00-00/211152/5 "2019-12-09T23:15:39Z")
Badger thanks a lot for your guidance, here is the exception. [2019-12-09T15:32:17,019][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"slap\_msgs", :\_type=\>"\_doc", :routing=\>nil}, #LogStash::Event:0x3134d74d], :response=\>{"index"=\>{"\_index"=\>"slap\_msgs", "\_type"=\>"\_doc", "\_id"=\>"5epc7G4BD6qqC3DZ0bRR", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field [msg\_time] of type [date] in document with id '5epc7G4BD6qqC3DZ0bRR'. Preview of field's value: '2019-10-17 21:04:39.244000+00:00'", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"failed to parse date field [2019-10-17 21:04:39.244000+00:00] with format [strict\_date\_optional\_time||epoch\_millis]", "caused\_by"=\>{"type"=\>"date\_time\_parse\_exception", "reason"=\>"date\_time\_parse\_exception: Failed to parse with all enclosed parsers"}}}}}} ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [December 10, 2019, 12:15am UTC](https://discuss.elastic.co/t/help-with-match-date-2019-12-04-0633-850000-00-00/211152/6 "2019-12-10T00:15:26Z")
elasticsearch expects the [log\_time] field to be a date. It is arriving as a string, and the default parser only understands strict\_date\_optional\_time and epoch\_millis. I assume the field that contains 2019-10-19 18:59:17.212000+00:00 is [log\_time]. You are parsing that using a date filter. If you are using the default target then that sets @timestamp but does not modify [log\_time], in which case I would expect that error all of the time. If you are using target =\> "log\_time" to modify [log\_time] then it is going to get a mapping exception when the date parser fails. There are several approaches you could take. You could get rid of the date filter and define a [custom parser](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html) in elasticsearch that can parse that text format. Personally I would probably check for a \_dateparsefailure and then use mutate+rename to rename log\_time to failed\_log\_time. ---
**Author:** ![LLhborda](https://avatars.discourse-cdn.com/v4/letter/l/a8b319/32.png) [@LLhborda](https://discuss.elastic.co/u/LLhborda)\ **Post date:** [December 10, 2019, 2:22pm UTC](https://discuss.elastic.co/t/help-with-match-date-2019-12-04-0633-850000-00-00/211152/7 "2019-12-10T14:22:48Z")
Badger, I will follow your directions, thanks again for getting back to us. One final questions is: Here is the .conf file, we are reading a csv file. ---- Start input { file { path =\> \ sincedb\_path =\> \ start\_position =\> "beginning" } } filter { csv { separator =\> "," columns =\> ["index","slap\_id","msg\_time","diag\_gw","diag\_ingesttime","diag\_conductortime","diag\_uuid","diag\_rssi","diag\_snr","diag\_sf","diag\_channel","site\_id"] remove\_field =\> ["host","path","message"] } date { match =\> ["msg\_time", "yyyy-mm-dd hh:mm:ss.SSSSSSZ"] target =\> "msg\_time" } # type convert number fields mutate {convert =\> ["index", "integer"]} mutate {convert =\> ["diag\_rssi", "integer"]} mutate {convert =\> ["diag\_snr", "integer"]} mutate {convert =\> ["diag\_sf", "integer"]} mutate {convert =\> ["diag\_channel", "integer"]} } output { elasticsearch{ hosts =\> \ user =\> \ password =\> \ index =\> \ } stdout {} } ---- End We are ingesting about 21,000,000 rows and the process fails for a few thousand rows. It would be great to understand why if fails for a few thousand rows. If I understand you correctly it should fail for all the rows, or did I get it wrong? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [December 10, 2019, 3:13pm UTC](https://discuss.elastic.co/t/help-with-match-date-2019-12-04-0633-850000-00-00/211152/8 "2019-12-10T15:13:05Z")
> [@LLhborda](#): > > match =\> ["msg\_time", "yyyy-mm-dd hh:mm:ss.SSSSSSZ"] Case matters. hh is the hour of the half day, so only valid from 1 to 12. mm is minute, not month. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 7, 2020, 3:13pm UTC](https://discuss.elastic.co/t/help-with-match-date-2019-12-04-0633-850000-00-00/211152/9 "2020-01-07T15:13:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.