# Invalid time format

**URL:** https://discuss.elastic.co/t/invalid-time-format/86042
**Category:** Elasticsearch
**Created:** [May 17, 2017, 4:49am UTC](https://discuss.elastic.co/t/invalid-time-format/86042 "2017-05-17T04:49:44Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Yong\_Zhang](https://avatars.discourse-cdn.com/v4/letter/y/a183cd/32.png) [@Yong\_Zhang](https://discuss.elastic.co/u/Yong_Zhang)
#### Post date: [May 17, 2017, 4:49am UTC](https://discuss.elastic.co/t/invalid-time-format/86042/1 "2017-05-17T04:49:44Z")

</div>

Hi, all

I'm using fluentd to send logs to elasticsearch'm but stuck at a time format issue below:

This is the sample log:  
[2017-05-16 01:28:05.980425] I [socket.c:4120:socket\_init] 0-tcp.devops-jenkins-server: SSL support on the I/O path is ENABLED

And here's the config in td-agent:

```auto
  <source>
    type tail
    path /var/log/glusterfs/bricks/*.log
    pos_file fluentd-glusterfs.pos
    format /^\[(?<time>[^\]]*)\] (?<log_level>[^]*) (?<message>[^].*)$/
    keep_time_key true
    time_key time
    time_format %Y-%m-%d %H:%M:%S
    tag glusterfs.*
    read_from_head true
  </source>

```

got error messages as below:

```auto
2017-05-16 10:08:57 +0800 [error]: Could not push log to Elasticsearch: {"took"=>13, "errors"=>true, "items"=>[{"index"=>{"_index"=>"devops-2017.05.15", "_type"=>"fluentd", "_id"=>"AVwPA_mKVVrEuXsVfdeC", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [time]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"[2017-05-16 01:28:05.980425\" is malformed at \" 01:28:05.980425\""}}}}

```

elasticsearch indexes are using dynamic mapping.  
How to fix this? Thanks for the help!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 14, 2017, 4:50am UTC](https://discuss.elastic.co/t/invalid-time-format/86042/2 "2017-06-14T04:50:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.