# Logstash 7.0.1 - Grok pattern

**URL:** <https://discuss.elastic.co/t/logstash-7-0-1-grok-pattern/181338>\
**Category:** Logstash\
**Created:** [May 16, 2019, 8:46am UTC](https://discuss.elastic.co/t/logstash-7-0-1-grok-pattern/181338 "2019-05-16T08:46:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hassen\_k](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hassen_k/32/46278_2.png) [@hassen\_k](https://discuss.elastic.co/u/hassen_k)\
**Post date:** [May 16, 2019, 8:46am UTC](https://discuss.elastic.co/t/logstash-7-0-1-grok-pattern/181338/1 "2019-05-16T08:46:25Z")

</div>

Hi,

I am using Logstash 7.0.1. I have the following log :

```
amPolicy:05/16/2019 05:47:31:262 AM CEST: Thread[http-nio-8080-exec-14,5,main]

```

The Logstash configuration is like that :

```
...
mutate {
     gsub => ["timestamp", "CEST", ""]
}
date {
       match => ["timestamp", "MM/dd/yyyy KK:mm:ss:SSS aa" , "MM/dd/yyyy hh:mm:ss:SSS a", "MM/dd/yyyy KK:mm:ss:SSS"]
       target => "@timestamp"
}
...

```

But I always receive the message **\_dateparsefailure**

```
t message	amPolicy:05/16/2019 05:47:31:262 AM CEST: Thread[http-nio-8080-exec-14,5,main]
t tags	openamlogs, _dateparsefailure
t timestamp	05/16/2019 05:47:31:262 AM 

```

Thanks for help  
H.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 16, 2019, 12:33pm UTC](https://discuss.elastic.co/t/logstash-7-0-1-grok-pattern/181338/2 "2019-05-16T12:33:59Z")

</div>

> [@hassen\_k](#):
>
> 05/16/2019 05:47:31:262 AM CEST

If you started with this then you removed the CEST but not the trailing space, so your timestamp field is

```
"05/16/2019 05:47:31:262 AM "

```

which does not match your pattern. Change the gsub to match

```
" CEST"

```

---

<div class="post-metadata">

**Author:** ![hassen\_k](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hassen_k/32/46278_2.png) [@hassen\_k](https://discuss.elastic.co/u/hassen_k)\
**Post date:** [May 16, 2019, 12:48pm UTC](https://discuss.elastic.co/t/logstash-7-0-1-grok-pattern/181338/3 "2019-05-16T12:48:51Z")

</div>

It is working.

Thanks a lot 🙏  
H.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 13, 2019, 12:48pm UTC](https://discuss.elastic.co/t/logstash-7-0-1-grok-pattern/181338/4 "2019-06-13T12:48:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.