# "Invalid format" message for a date format that always worked. Why the sudden date parsing error? **URL:** \ **Category:** Logstash\ **Created:** [January 10, 2018, 9:32pm UTC](https://discuss.elastic.co/t/invalid-format-message-for-a-date-format-that-always-worked-why-the-sudden-date-parsing-error/114966 "2018-01-10T21:32:44Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![dorj1234](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dorj1234/32/21339_2.png) [@dorj1234](https://discuss.elastic.co/u/dorj1234)\ **Post date:** [January 10, 2018, 9:32pm UTC](https://discuss.elastic.co/t/invalid-format-message-for-a-date-format-that-always-worked-why-the-sudden-date-parsing-error/114966/1 "2018-01-10T21:32:44Z")
Hello, I have had csv files for a long time parsing correctly, but something changed and I get the error below. My "run\_date" is a simple field that looks like this in the data files: "2017-12-28" It always worked. I mutated it like this, never had a problem. > date { > match =\> ["run\_date", "yyyy-MM-dd"] > } My data csv files changed, got added columns, but nothing relevant to this problem has changed. The main change is the upgrade to ELK 6.X but maybe it's just a coincidence. Below is the error log related to this post, and I cannot understand the problem from the log. Any advice greatly appreciated. `[2018-01-10T16:17:22,977][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>"c6f45790ab274ac98083dec77711f6d9f8d19496", :_index=>"company_test", :_type=>"doc", :_routing=>nil}, #], :response=>{"index"=>{"_index"=>"company_test", "_type"=>"doc", "_id"=>"c6f45790ab274ac98083dec77711f6d9f8d19496", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [run_date]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"run_date\""}}}}}` Best, Dor Juravski ---
**Author:** ![Krunal\_kalaria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krunal_kalaria/32/23862_2.png) [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)\ **Post date:** [January 11, 2018, 4:20am UTC](https://discuss.elastic.co/t/invalid-format-message-for-a-date-format-that-always-worked-why-the-sudden-date-parsing-error/114966/2 "2018-01-11T04:20:25Z")
Hi @dorj1234, try this one i hope its working. ``` date { match => ["run_date", "UNIX_MS"] target => "run_date_New" } ``` ---
**Author:** ![dorj1234](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dorj1234/32/21339_2.png) [@dorj1234](https://discuss.elastic.co/u/dorj1234)\ **Post date:** [January 15, 2018, 5:54pm UTC](https://discuss.elastic.co/t/invalid-format-message-for-a-date-format-that-always-worked-why-the-sudden-date-parsing-error/114966/3 "2018-01-15T17:54:14Z")
Thank you for the suggestion Krinal - UNIX\_MS is meant to parse int values (see [here](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html)) and I have a yyyy-MM-dd string to parse. Any other suggestions by anyone? thank you in advance. JD ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 23, 2018, 9:00pm UTC](https://discuss.elastic.co/t/invalid-format-message-for-a-date-format-that-always-worked-why-the-sudden-date-parsing-error/114966/4 "2018-01-23T21:00:34Z")
It looks like you're trying to index a document where the `run_date` field contains the string "run\_date". Perhaps a column header? ---
**Author:** ![dorj1234](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dorj1234/32/21339_2.png) [@dorj1234](https://discuss.elastic.co/u/dorj1234)\ **Post date:** [January 24, 2018, 2:18pm UTC](https://discuss.elastic.co/t/invalid-format-message-for-a-date-format-that-always-worked-why-the-sudden-date-parsing-error/114966/5 "2018-01-24T14:18:57Z")
I wish it was that, but: 1. I always had a conf line that drops the header. The drop runs before the date clause. 2. It always worked, and my conf file never changed, my data never changed The only thing that changed to my knowledge is the logstash version. If I am wrong in the above assumptions - can you suggest a debug option that will show the value of run\_date and information on the specific csv file with the bad input? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 25, 2018, 12:51pm UTC](https://discuss.elastic.co/t/invalid-format-message-for-a-date-format-that-always-worked-why-the-sudden-date-parsing-error/114966/6 "2018-01-25T12:51:31Z")
> If I am wrong in the above assumptions - can you suggest a debug option that will show the value of run\_date and information on the specific csv file with the bad input? You could e.g. temporarily replace the elasticsearch output with a `stdout { codec => elasticsearch }` output so that Logstash dumps the raw events into its log. ---
**Author:** ![dorj1234](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dorj1234/32/21339_2.png) [@dorj1234](https://discuss.elastic.co/u/dorj1234)\ **Post date:** [January 25, 2018, 2:38pm UTC](https://discuss.elastic.co/t/invalid-format-message-for-a-date-format-that-always-worked-why-the-sudden-date-parsing-error/114966/7 "2018-01-25T14:38:05Z")
I did that, it looked as expected. yyyy-MM-dd. I am guessing that the records that raise this error don't show up on stdout, do they? My goal is to find them, maybe understand if there is a difference. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 22, 2018, 2:38pm UTC](https://discuss.elastic.co/t/invalid-format-message-for-a-date-format-that-always-worked-why-the-sudden-date-parsing-error/114966/8 "2018-02-22T14:38:07Z")
Closed on February 22, 2018, 2:38pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.