# Logstash capture error message

**URL:** <https://discuss.elastic.co/t/logstash-capture-error-message/38966>\
**Category:** Logstash\
**Created:** [January 12, 2016, 10:41am UTC](https://discuss.elastic.co/t/logstash-capture-error-message/38966 "2016-01-12T10:41:48Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![chicco\_95](https://avatars.discourse-cdn.com/v4/letter/c/ce7236/32.png) [@chicco\_95](https://discuss.elastic.co/u/chicco_95)\
**Post date:** [January 12, 2016, 10:41am UTC](https://discuss.elastic.co/t/logstash-capture-error-message/38966/1 "2016-01-12T10:41:49Z")

</div>

Hi all,  
I'm trying to capture the error message that is generated for a \_dateparsefailure.

an example of message is this:

Failed parsing date from field {:field=\>"Data/Ora Chiusura TT", :value=\>"07/10/2015 11.04.12", :exception=\>"Invalid format: "07/10/2015 11.04.12" is malformed at "/10/2015 11.04.12"", :config\_parsers=\>"dd/MM-YYYY HH.mm.ss,ISO8601", :config\_locale=\>"default=en\_US", :level=\>:warn}  
Failed parsing date from field {:field=\>"Data/Ora Chiusura TT", :value=\>"06/10/2015 21.03.45", :exception=\>"Invalid format: "06/10/2015 21.03.45" is malformed at "/10/2015 21.03.45"", :config\_parsers=\>"dd/MM-YYYY HH.mm.ss,ISO8601", :config\_locale=\>"default=en\_US", :level=\>:warn}  
Failed parsing date from field {:field=\>"Data/Ora Chiusura TT", :value=\>"08/10/2015 15.03.25", :exception=\>"Invalid format: "08/10/2015 15.03.25" is malformed at "/10/2015 15.03.25"", :config\_parsers=\>"dd/MM-YYYY HH.mm.ss,ISO8601", :config\_locale=\>"default=en\_US", :level=\>:warn}  
Failed parsing date from field {:field=\>"Data/Ora Chiusura TT", :value=\>"11/10/2015 18.33.42", :exception=\>"Invalid format: "11/10/2015 18.33.42" is malformed at "/10/2015 18.33.42"", :config\_parsers=\>"dd/MM-YYYY HH.mm.ss,ISO8601", :config\_locale=\>"default=en\_US", :level=\>:warn}  
Failed parsing date from field {:field=\>"Data/Ora Chiusura TT", :value=\>"06/10/2015 21.04.27", :exception=\>"Invalid format: "06/10/2015 21.04.27" is malformed at "/10/2015 21.04.27"", :config\_parsers=\>"dd/MM-YYYY HH.mm.ss,ISO8601", :config\_locale=\>"default=en\_US", :level=\>:warn}  
Failed parsing date from field {:field=\>"Data/Ora Chiusura TT", :value=\>"10/10/2015 09.38.27", :exception=\>"Invalid format: "10/10/2015 09.38.27" is malformed at "/10/2015 09.38.27"", :config\_parsers=\>"dd/MM-YYYY HH.mm.ss,ISO8601", :config\_locale=\>"default=en\_US", :level=\>:warn}  
Failed parsing date from field {:field=\>"Data/Ora Chiusura TT", :value=\>"11/10/2015 14.25.56", :exception=\>"Invalid format: "11/10/2015 14.25.56" is malformed at "/10/2015 14.25.56"", :config\_parsers=\>"dd/MM-YYYY HH.mm.ss,ISO8601", :config\_locale=\>"default=en\_US", :level=\>:warn}  
Failed parsing date from field {:field=\>"Data/Ora Chiusura TT", :value=\>"07/10/2015 14.07.22", :exception=\>"Invalid format: "07/10/2015 14.07.22" is malformed at "/10/2015 14.07.22"", :config\_parsers=\>"dd/MM-YYYY HH.mm.ss,ISO8601", :config\_locale=\>"default=en\_US", :level=\>:warn}  
Failed parsing date from field {:field=\>"Data/Ora Chiusura TT", :value=\>"10/10/2015 09.57.24", :exception=\>"Invalid format: "10/10/2015 09.57.24" is malformed at "/10/2015 09.57.24"", :config\_parsers=\>"dd/MM-YYYY HH.mm.ss,ISO8601", :config\_locale=\>"default=en\_US", :level=\>:warn}  
Failed parsing date from field {:field=\>"Data/Ora Chiusura TT", :value=\>"11/10/2015 14.25.56", :exception=\>"Invalid format: "11/10/2015 14.25.56" is malformed at "/10/2015 14.25.56"", :config\_parsers=\>"dd/MM-YYYY HH.mm.ss,ISO8601", :config\_locale=\>"default=en\_US", :level=\>:warn}  
Failed parsing date from field {:field=\>"Data/Ora Chiusura TT", :value=\>"10/10/2015 09.57.24", :exception=\>"Invalid format: "10/10/2015 09.57.24" is malformed at "/10/2015 09.57.24"", :config\_parsers=\>"dd/MM-YYYY HH.mm.ss,ISO8601", :config\_locale=\>"default=en\_US", :level=\>:warn}  
Failed parsing date from field {:field=\>"Data/Ora Chiusura TT", :value=\>"10/10/2015 09.57.24", :exception=\>"Invalid format: "10/10/2015 09.57.24" is malformed at "/10/2015 09.57.24"", :config\_parsers=\>"dd/MM-YYYY HH.mm.ss,ISO8601", :config\_locale=\>"default=en\_US", :level=\>:warn}  
Failed parsing date from field {:field=\>"Data/Ora Chiusura TT", :value=\>"05/10/2015 09.57.43", :exception=\>"Invalid format: "05/10/2015 09.57.43" is malformed at "/10/2015 09.57.43"", :config\_parsers=\>"dd/MM-YYYY HH.mm.ss,ISO8601", :config\_locale=\>"default=en\_US", :level=\>:warn}  
Failed parsing date from field {:field=\>"Data/Ora Chiusura TT", :value=\>"10/10/2015 09.57.24", :exception=\>"Invalid format: "10/10/2015 09.57.24" is malformed at "/10/2015 09.57.24"", :config\_parsers=\>"dd/MM-YYYY HH.mm.ss,ISO8601", :config\_locale=\>"default=en\_US", :level=\>:warn}  
Failed parsing date from field {:field=\>"Data/Ora Chiusura TT", :value=\>"07/10/2015 12.27.27", :exception=\>"Invalid format: "07/10/2015 12.27.27" is malformed at "/10/2015 12.27.27"", :config\_parsers=\>"dd/MM-YYYY HH.mm.ss,ISO8601", :config\_locale=\>"default=en\_US", :level=\>:warn}  
Failed parsing date from field {:field=\>"Data/Ora Chiusura TT", :value=\>"06/10/2015 19.27.41", :exception=\>"Invalid format: "06/10/2015 19.27.41" is malformed at "/10/2015 19.27.41"", :config\_parsers=\>"dd/MM-YYYY HH.mm.ss,ISO8601", :config\_locale=\>"default=en\_US", :level=\>:warn}

I would like to take this message and I will write to a file , how can I do it ?

thank you

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 12, 2016, 10:57am UTC](https://discuss.elastic.co/t/logstash-capture-error-message/38966/2 "2016-01-12T10:57:56Z")

</div>

How about configuring Logstash to read its own logfile and drop all lines except those that begin with "Failed parsing date from field"?

---

<div class="post-metadata">

**Author:** ![chicco\_95](https://avatars.discourse-cdn.com/v4/letter/c/ce7236/32.png) [@chicco\_95](https://discuss.elastic.co/u/chicco_95)\
**Post date:** [January 12, 2016, 11:07am UTC](https://discuss.elastic.co/t/logstash-capture-error-message/38966/3 "2016-01-12T11:07:05Z")

</div>

I am creating a log file , now does not know where that message is write .  
I see those messages from my virtual terminal

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 12, 2016, 11:20am UTC](https://discuss.elastic.co/t/logstash-capture-error-message/38966/4 "2016-01-12T11:20:34Z")

</div>

I'm afraid I don't understand.

---

<div class="post-metadata">

**Author:** ![chicco\_95](https://avatars.discourse-cdn.com/v4/letter/c/ce7236/32.png) [@chicco\_95](https://discuss.elastic.co/u/chicco_95)\
**Post date:** [January 12, 2016, 11:26am UTC](https://discuss.elastic.co/t/logstash-capture-error-message/38966/5 "2016-01-12T11:26:47Z")

</div>

yes, sorry for my English

i don't take this message from a log file, but i see this message when i launch logstash on a virtual terminal..... and i want take that error message and put it on a file

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 12, 2016, 12:08pm UTC](https://discuss.elastic.co/t/logstash-capture-error-message/38966/6 "2016-01-12T12:08:35Z")

</div>

Okay, but normally when you run Logstash for real the text you're talking about is logged to a logfile, typically /var/log/logstash/logstash.log. Configure Logstash to read _that_ file.

---

<div class="post-metadata">

**Author:** ![chicco\_95](https://avatars.discourse-cdn.com/v4/letter/c/ce7236/32.png) [@chicco\_95](https://discuss.elastic.co/u/chicco_95)\
**Post date:** [January 12, 2016, 1:48pm UTC](https://discuss.elastic.co/t/logstash-capture-error-message/38966/7 "2016-01-12T13:48:00Z")

</div>

I do not have that file (logstash.log) and that folder (logstash)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 12, 2016, 5:53pm UTC](https://discuss.elastic.co/t/logstash-capture-error-message/38966/8 "2016-01-12T17:53:57Z")

</div>

Okay. Well, you should configure Logstash to save its logs to a file. Use the `-l` command line option.

---

<div class="post-metadata">

**Author:** ![chicco\_95](https://avatars.discourse-cdn.com/v4/letter/c/ce7236/32.png) [@chicco\_95](https://discuss.elastic.co/u/chicco_95)\
**Post date:** [January 15, 2016, 8:46am UTC](https://discuss.elastic.co/t/logstash-capture-error-message/38966/9 "2016-01-15T08:46:14Z")

</div>

ok tnks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:15am UTC](https://discuss.elastic.co/t/logstash-capture-error-message/38966/10 "2017-07-06T05:15:38Z")

</div>