# Keep getting dateparsefailures in Nexus logs

**URL:** <https://discuss.elastic.co/t/keep-getting-dateparsefailures-in-nexus-logs/228218>\
**Category:** Logstash\
**Created:** [April 15, 2020, 11:26pm UTC](https://discuss.elastic.co/t/keep-getting-dateparsefailures-in-nexus-logs/228218 "2020-04-15T23:26:17Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![niudaye123](https://avatars.discourse-cdn.com/v4/letter/n/85e7bf/32.png) [@niudaye123](https://discuss.elastic.co/u/niudaye123)\
**Post date:** [April 15, 2020, 11:26pm UTC](https://discuss.elastic.co/t/keep-getting-dateparsefailures-in-nexus-logs/228218/1 "2020-04-15T23:26:17Z")

</div>

Hi,  
I keep getting the dateparsefailure from a Nexus device, could not figure out what's wrong, can someone take a quick look? Thanks a lot!

{  
"\_index": "network-2020.04.14",  
"\_type": "\_doc",  
"\_id": "OaQHd3EB-3-fVVnV4l2f",  
"\_version": 1,  
"\_score": 0,  
"\_source": {  
"log\_date": "2020 Apr 13 21:52:17.496 Pacific Daylight Time",  
"host": "10.149.10.134",  
"facility": "ETH\_PORT\_CHANNEL",  
"tags": [  
"cisco",  
"\_dateparsefailure"  
],  
"@timestamp": "2020-04-14T04:52:17.514Z",  
"severity\_level": "5 - Notification",  
"type": "syslog-cisco",  
"fingerprint": "852be74a10a7a7dc4b7804789b39449e6eaf2639",  
"message": "port-channel110: Ethernet1/10 is down",  
"facility\_mnemonic": "PORT\_DOWN"  
},  
"fields": {  
"@timestamp": [  
"2020-04-14T04:52:17.514Z"  
]  
},  
"highlight": {  
"host": [  
"@kibana-highlighted-field@10.149.10.134@/kibana-highlighted-field@"  
],  
"host.keyword": [  
"@kibana-highlighted-field@10.149.10.134@/kibana-highlighted-field@"  
]  
}  
}

The following is my filter for date:

date {  
match =\> [  
"log\_date",

```
    # IOS
    "MMM dd HH:mm:ss.SSS ZZZ",
    "MMM d HH:mm:ss.SSS ZZZ",
    "MMM dd HH:mm:ss ZZZ",
    "MMM d HH:mm:ss ZZZ",
    "MMM dd HH:mm:ss.SSS",
    "MMM d HH:mm:ss.SSS",

    # Nexus
    "YYYY MMM dd HH:mm:ss.SSS ZZZ",
    "YYYY MMM dd HH:mm:ss ZZZ",
    "YYYY MMM dd HH:mm:ss.SSS",

    # Hail marry
    "ISO8601"
  ]
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 16, 2020, 12:52am UTC](https://discuss.elastic.co/t/keep-getting-dateparsefailures-in-nexus-logs/228218/2 "2020-04-16T00:52:35Z")

</div>

> [@niudaye123](#):
>
> "log\_date": "2020 Apr 13 21:52:17.496 Pacific Daylight Time"

Joda has a [list](http://joda-time.sourceforge.net/timezones.html) of timezone names that it supports, and that is not on it. You can use mutate+gsub to replace the timezone name with something that Joda supports.

---

<div class="post-metadata">

**Author:** ![niudaye123](https://avatars.discourse-cdn.com/v4/letter/n/85e7bf/32.png) [@niudaye123](https://discuss.elastic.co/u/niudaye123)\
**Post date:** [April 17, 2020, 9:03pm UTC](https://discuss.elastic.co/t/keep-getting-dateparsefailures-in-nexus-logs/228218/3 "2020-04-17T21:03:28Z")

</div>

Hi Badger, thanks for the reply, I do have a mutate+gsub as below right before the date filter. But that seems it doesn't work, what should it be changed to?

if "cisco" in [tags] {

```
# Add the following to get timezone right.
mutate {
  gsub => [
    "log_date", "PDT", "Pacific Daylight Time"
  ]
  gsub => [
    "log_date", "PST", "Pacific Standard Time"
  ]
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 17, 2020, 10:06pm UTC](https://discuss.elastic.co/t/keep-getting-dateparsefailures-in-nexus-logs/228218/4 "2020-04-17T22:06:36Z")

</div>

Try

```
mutate { gsub => ["log_date", "PST|PDT", "PST8PDT"] }
```

---

<div class="post-metadata">

**Author:** ![niudaye123](https://avatars.discourse-cdn.com/v4/letter/n/85e7bf/32.png) [@niudaye123](https://discuss.elastic.co/u/niudaye123)\
**Post date:** [April 20, 2020, 10:12pm UTC](https://discuss.elastic.co/t/keep-getting-dateparsefailures-in-nexus-logs/228218/5 "2020-04-20T22:12:14Z")

</div>

That works! Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 18, 2020, 10:12pm UTC](https://discuss.elastic.co/t/keep-getting-dateparsefailures-in-nexus-logs/228218/6 "2020-05-18T22:12:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.