Keep getting dateparsefailures in Nexus logs

I keep getting the dateparsefailure from a Nexus device, could not figure out what's wrong, can someone take a quick look? Thanks a lot!

"_index": "network-2020.04.14",
"_type": "_doc",
"_id": "OaQHd3EB-3-fVVnV4l2f",
"_version": 1,
"_score": 0,
"_source": {
"log_date": "2020 Apr 13 21:52:17.496 Pacific Daylight Time",
"host": "",
"facility": "ETH_PORT_CHANNEL",
"tags": [
"@timestamp": "2020-04-14T04:52:17.514Z",
"severity_level": "5 - Notification",
"type": "syslog-cisco",
"fingerprint": "852be74a10a7a7dc4b7804789b39449e6eaf2639",
"message": "port-channel110: Ethernet1/10 is down",
"facility_mnemonic": "PORT_DOWN"
"fields": {
"@timestamp": [
"highlight": {
"host": [
"host.keyword": [

The following is my filter for date:

date {
match => [

    # IOS
    "MMM dd HH:mm:ss.SSS ZZZ",
    "MMM  d HH:mm:ss.SSS ZZZ",
    "MMM dd HH:mm:ss ZZZ",
    "MMM  d HH:mm:ss ZZZ",
    "MMM dd HH:mm:ss.SSS",
    "MMM  d HH:mm:ss.SSS",

    # Nexus
    "YYYY MMM dd HH:mm:ss.SSS ZZZ",
    "YYYY MMM dd HH:mm:ss ZZZ",
    "YYYY MMM dd HH:mm:ss.SSS",

    # Hail marry

Joda has a list of timezone names that it supports, and that is not on it. You can use mutate+gsub to replace the timezone name with something that Joda supports.

Hi Badger, thanks for the reply, I do have a mutate+gsub as below right before the date filter. But that seems it doesn't work, what should it be changed to?

if "cisco" in [tags] {

# Add the following to get timezone right.
mutate {
  gsub => [
    "log_date", "PDT", "Pacific Daylight Time"
  gsub => [
    "log_date", "PST", "Pacific Standard Time"


mutate { gsub => [ "log_date", "PST|PDT", "PST8PDT" ] }

That works! Thank you!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.