# Logstash cannot parse httpdate even pattern is correct

**URL:** <https://discuss.elastic.co/t/logstash-cannot-parse-httpdate-even-pattern-is-correct/218907>\
**Category:** Logstash\
**Created:** [February 12, 2020, 6:39am UTC](https://discuss.elastic.co/t/logstash-cannot-parse-httpdate-even-pattern-is-correct/218907 "2020-02-12T06:39:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rogerwang](https://avatars.discourse-cdn.com/v4/letter/r/ea5d25/32.png) [@rogerwang](https://discuss.elastic.co/u/rogerwang)\
**Post date:** [February 12, 2020, 6:39am UTC](https://discuss.elastic.co/t/logstash-cannot-parse-httpdate-even-pattern-is-correct/218907/1 "2020-02-12T06:39:56Z")

</div>

Hi,  
I was converting the filebeat pipeline to logstash since I need to use the translate filter. everything seems fine except the date filter is giving me the "\_dateparsefailure" and it is not able to parse the time correctly.

In order to simplify the question, I use below command to debug:

```
# echo "09/Feb/2020:07:12:13 +1100" | /usr/share/logstash/bin/logstash -e 'input { stdin {} } filter {date { match => ["message","dd/MMM/yyyy:HH:mm:ss Z"] } } output { stdout { codec => rubydebug } }'

```

As you can see in the result, the time is not parsed:

```auto
{
      "@version" => "1",
       "message" => "09/Feb/2020:07:12:13 +1100",
          "tags" => [
        [0] "_dateparsefailure"
    ],
    "@timestamp" => 2020-02-12T06:26:35.593Z,
          "host" => "au1-int-elk03"
}

```

I don't know why this is happened and how to fix the problem.

---

<div class="post-metadata">

**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\
**Post date:** [February 12, 2020, 8:21am UTC](https://discuss.elastic.co/t/logstash-cannot-parse-httpdate-even-pattern-is-correct/218907/2 "2020-02-12T08:21:07Z")

</div>

I dont know, this looks strange, have you tried to strip the "/" maybe this is it ?

---

<div class="post-metadata">

**Author:** ![rogerwang](https://avatars.discourse-cdn.com/v4/letter/r/ea5d25/32.png) [@rogerwang](https://discuss.elastic.co/u/rogerwang)\
**Post date:** [February 12, 2020, 11:38am UTC](https://discuss.elastic.co/t/logstash-cannot-parse-httpdate-even-pattern-is-correct/218907/3 "2020-02-12T11:38:43Z")

</div>

Finally solve it. It should be logstash compatibility issue with the Java 11 openjdk. Once I downgrade the java version to 1.8.0 and the problem is fixed immediately. Just report here in case someone has the same problem.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 11, 2020, 11:38am UTC](https://discuss.elastic.co/t/logstash-cannot-parse-httpdate-even-pattern-is-correct/218907/4 "2020-03-11T11:38:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.