# Logstash date filter error

**URL:** <https://discuss.elastic.co/t/logstash-date-filter-error/310268>\
**Category:** Logstash\
**Created:** [July 21, 2022, 10:24am UTC](https://discuss.elastic.co/t/logstash-date-filter-error/310268 "2022-07-21T10:24:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![yugeeklab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yugeeklab/32/108180_2.png) [@yugeeklab](https://discuss.elastic.co/u/yugeeklab)\
**Post date:** [July 21, 2022, 10:24am UTC](https://discuss.elastic.co/t/logstash-date-filter-error/310268/1 "2022-07-21T10:24:30Z")

</div>

```auto
 filter {
     if "client" in [tags] {
          grok {
            match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} MysqlClient:SYSTEM_USER:%{QS:mysql_client.system_user}, MYSQL_USER:%{QS:mysql_client.mysql_user}, CONNECTION_ID:%{NUMBER:mysql_client.connection_id}, DB_SERVER:%{QS:mysql_client.db_server}, DB:%{QS:mysql_client.db}, QUERY:%{QS:mysql_client.query}" 
                             }
          }
          date {
            match => ["timestamp", "yyyy-MM-dd hh:mm:ss.SSS"]
            target => "after_timestamp"
            timezone => "Asia/Seoul"
            add_tag => ["date"]
          }
     }
}

```

result

```auto
{
"mysql_client.query" => "'t;'",
"@timestamp" => 2022-07-21T10:08:14.192Z,
"mysql_client.db_server" => "'--'",
"tags" => [
[0] "client",
[1] "beats_input_codec_plain_applied",
[2] "_dateparsefailure"
],
"timestamp" => "2022-07-21 19:08:07.8218",
"mysql_client.db" => "'--'",
"message" => "2022-07-21 19:08:07.8218 MysqlClient:SYSTEM_USER:'deploy', MYSQL_USER:'root', CONNECTION_ID:19, DB_SERVER:'--', DB:'--', QUERY:'t;'",
"ecs" => {
"version" => "1.6.0"
},
"mysql_client.mysql_user" => "'root'",
"mysql_client.connection_id" => "19",
"@version" => "1",
...
}

```

Can you find the wrong point?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 21, 2022, 12:48pm UTC](https://discuss.elastic.co/t/logstash-date-filter-error/310268/2 "2022-07-21T12:48:35Z")

</div>

> [@yugeeklab](#):
>
> `"timestamp" => "2022-07-21 19:08:07.8218",`

SSS will not match 8218. Try "yyyy-MM-dd hh:mm:ss.SSSS"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 18, 2022, 12:49pm UTC](https://discuss.elastic.co/t/logstash-date-filter-error/310268/3 "2022-08-18T12:49:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.