# Logstash CSV filter - \_dateparsefailure from string to date

**URL:** <https://discuss.elastic.co/t/logstash-csv-filter-dateparsefailure-from-string-to-date/266189>\
**Category:** Logstash\
**Created:** [March 4, 2021, 7:28am UTC](https://discuss.elastic.co/t/logstash-csv-filter-dateparsefailure-from-string-to-date/266189 "2021-03-04T07:28:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pmaganti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pmaganti/32/84930_2.png) [@pmaganti](https://discuss.elastic.co/u/pmaganti)\
**Post date:** [March 4, 2021, 7:28am UTC](https://discuss.elastic.co/t/logstash-csv-filter-dateparsefailure-from-string-to-date/266189/1 "2021-03-04T07:28:46Z")

</div>

Hello,

I am trying to set a field from CSV as @timestamp and is failing with a tag \_dateparsefailure.

Following is the config.

```auto
input {
  beats {
    port => 5044
  }
}
filter {
  csv {
    separator => ","
    autodetect_column_names => true
  }

mutate { add_field => { "TimeStamp1" => "%{TimeStamp}" } }

  date {
    match => ["TimeStamp1", "yyyy-MM-dd HH:mm:ss'ZZ'"]
    timezone => "UTC"
    target => "TimeStamp1"
  }

}
output {
  elasticsearch {
    hosts => ["localhost:9200"]
    manage_template => false
    index => "telematics-%{+YYYY.MM.dd}"
  }
}   

```

Tried the following and got no errors

```auto
echo "2021-02-22 21:56:02+00:00" | sudo /usr/share/logstash/bin/logstash -e 'input { stdin {} } filter { date { match => ["message", "yyyy-MM-dd HH:mm:ss'Z'"] timezone => "UTC" target => "@timestamp" } }'

```

Result:

```auto
{
   "message" => "2021-02-22 21:56:02+00:00",
   "host" => "ip-172-31-15-47",
   "@version" => "1",
   "@timestamp" => 2021-02-22T21:56:02.000Z
}

```

For reference, this is the date string coming from csv - `2021-02-22T21:56:02.000Z`

Could you help me understand if I am missing anything with the date format match?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 4, 2021, 4:49pm UTC](https://discuss.elastic.co/t/logstash-csv-filter-dateparsefailure-from-string-to-date/266189/2 "2021-03-04T16:49:16Z")

</div>

I would expect `"yyyy-MM-dd HH:mm:ssZZ"`to match "2021-02-22 21:56:02+00:00". `"yyyy-MM-dd HH:mm:ss'ZZ'"` would match "2021-02-22 21:56:02ZZ".

---

<div class="post-metadata">

**Author:** ![pmaganti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pmaganti/32/84930_2.png) [@pmaganti](https://discuss.elastic.co/u/pmaganti)\
**Post date:** [March 4, 2021, 6:06pm UTC](https://discuss.elastic.co/t/logstash-csv-filter-dateparsefailure-from-string-to-date/266189/3 "2021-03-04T18:06:57Z")

</div>

Thank you @Badger. It worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 1, 2021, 6:07pm UTC](https://discuss.elastic.co/t/logstash-csv-filter-dateparsefailure-from-string-to-date/266189/4 "2021-04-01T18:07:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.