# Logstash \_dateparsefailure error

**URL:** <https://discuss.elastic.co/t/logstash--dateparsefailure-error/35819>\
**Category:** Logstash\
**Created:** [November 29, 2015, 8:26am UTC](https://discuss.elastic.co/t/logstash--dateparsefailure-error/35819 "2015-11-29T08:26:45Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![gugansankar](https://avatars.discourse-cdn.com/v4/letter/g/e274bd/32.png) [@gugansankar](https://discuss.elastic.co/u/gugansankar)\
**Post date:** [November 29, 2015, 8:26am UTC](https://discuss.elastic.co/t/logstash--dateparsefailure-error/35819/1 "2015-11-29T08:26:46Z")

</div>

How do I match the below timestamp value ?. I'm getting dateparsefailure error.

Log Timestamp:

```
        2015-11-28 16:46:41,553

```

Filter config:

> grok {  
> match =\> [  
> "message", "%{TIMESTAMP\_ISO8601:timestamp}"  
> ]  
> }  
> date {  
> match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss"]  
> timezone =\> "UTC"  
> add\_field =\> { "Status" =\> "Matched"}
> 
> }  
> }

Output :

> root@gugan:~/ELK# echo '2015-09-30 05:54:22,907' | /opt/logstash/bin/logstash -f test.config  
> Logstash startup completed  
> Failed parsing date from field {:field=\>"timestamp", :value=\>"2015-09-30 05:54:22,907", :exception=\>"Invalid format: "2015-09-30 05:54:22,907" is malformed at ",907"", :config\_parsers=\>"yyyy-MM-dd HH:mm:ss", :config\_locale=\>"default=en\_IN", :level=\>:warn}  
> {  
> "message" =\> "2015-09-30 05:54:22,907",  
> "@version" =\> "1",  
> "@timestamp" =\> "2015-11-29T08:14:34.569Z",  
> "host" =\> "gugan",  
> "timestamp" =\> "2015-09-30 05:54:22,907",  
> "tags" =\> [  
> [0] "\_dateparsefailure"  
> ]  
> }  
> Logstash shutdown completed  
> root@gugan:~/ELK#

---

<div class="post-metadata">

**Author:** ![vtst2412](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vtst2412/32/6228_2.png) [@vtst2412](https://discuss.elastic.co/u/vtst2412)\
**Post date:** [November 29, 2015, 9:31am UTC](https://discuss.elastic.co/t/logstash--dateparsefailure-error/35819/2 "2015-11-29T09:31:15Z")

</div>

```
  grok {
     match => ["message", "%{TIMESTAMP_ISO8601:timestamp}"]
  }
  date {
       match => ["timestamp", "yyyy-MM-dd HH:mm:ss,SSS"]
       timezone => "UTC"
       add_field => { "Status" => "Matched"} # add_tag => ["timestamp_matched"]
       remove_field => ["timestamp"]
   }

```

You don't really need the target field as @timestamp is the default target. It's good practice to remove the original timestamp field. And this probably also doesn't matter much, but instead of add\_field, consider add\_tag for marker/meta data like "matched".

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 29, 2015, 10:21am UTC](https://discuss.elastic.co/t/logstash--dateparsefailure-error/35819/3 "2015-11-29T10:21:33Z")

</div>

The error message points to you ",907" as the problematic part, and indeed your date pattern clearly doesn't include the milliseconds. You need to use "yyyy-MM-dd HH:mm:ss,SSS".

---

<div class="post-metadata">

**Author:** ![gugansankar](https://avatars.discourse-cdn.com/v4/letter/g/e274bd/32.png) [@gugansankar](https://discuss.elastic.co/u/gugansankar)\
**Post date:** [November 29, 2015, 11:01am UTC](https://discuss.elastic.co/t/logstash--dateparsefailure-error/35819/4 "2015-11-29T11:01:25Z")

</div>

no , its not working. still I'm getting the error.

> root@gugan:~/ELK# echo '2015-11-28 16:46:41,587' | /opt/logstash/bin//logstash -f test.config  
> Logstash startup completed  
> Failed parsing date from field {:field=\>"timestamp", :value=\>"2015-11-28 16:46:41,587", :exception=\>"Invalid format: "2015-11-28 16:46:41,587" is malformed at ",587"", :config\_parsers=\>"yyyy-MM-dd HH:mm:ss.SSS", :config\_locale=\>"default=en\_IN", :level=\>:warn}  
> {  
> "message" =\> "2015-11-28 16:46:41,587",  
> "@version" =\> "1",  
> "@timestamp" =\> "2015-11-29T11:01:52.949Z",  
> "host" =\> "gugan",  
> "timestamp" =\> "2015-11-28 16:46:41,587",  
> "tags" =\> [  
> [0] "\_dateparsefailure"  
> ]  
> }  
> Logstash shutdown completed  
> root@gugan:~/ELK#

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 29, 2015, 4:32pm UTC](https://discuss.elastic.co/t/logstash--dateparsefailure-error/35819/5 "2015-11-29T16:32:55Z")

</div>

I'd expect it to work better if you try putting a comma before "SSS" instead of a period.

---

<div class="post-metadata">

**Author:** ![gugansankar](https://avatars.discourse-cdn.com/v4/letter/g/e274bd/32.png) [@gugansankar](https://discuss.elastic.co/u/gugansankar)\
**Post date:** [November 29, 2015, 4:57pm UTC](https://discuss.elastic.co/t/logstash--dateparsefailure-error/35819/6 "2015-11-29T16:57:16Z")

</div>

Thanks, its working.

before post the issue here ,I used this .SSS option while debug this issue. But I did same mistake, Used period instead of comma. 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:20am UTC](https://discuss.elastic.co/t/logstash--dateparsefailure-error/35819/7 "2017-07-06T05:20:54Z")

</div>