# Logstash의 date 필터의 invalid format

**URL:** <https://discuss.elastic.co/t/logstash-date-invalid-format/77112>\
**Category:** 한국어 질문 및 토론\
**Created:** [March 2, 2017, 8:42am UTC](https://discuss.elastic.co/t/logstash-date-invalid-format/77112 "2017-03-02T08:42:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![TaeSung\_Kim](https://avatars.discourse-cdn.com/v4/letter/t/c2a13f/32.png) [@TaeSung\_Kim](https://discuss.elastic.co/u/TaeSung_Kim)\
**Post date:** [March 2, 2017, 8:42am UTC](https://discuss.elastic.co/t/logstash-date-invalid-format/77112/1 "2017-03-02T08:42:15Z")

</div>

안녕하세요.

logstash 의 date 필터에서 아래와 같이 설정하였는데, invalid format 에러가 발생해서요.

[2017-03-02T08:30:00,265][WARN][logstash.outputs.elasticsearch] Failed action. {:status=\>400, :action=\>["index", {:\_id=\>"4086972", :\_index=\>"erinapplog-2017.03.02", :\_type=\>"erinapplog", :\_routing=\>nil}, 2017-03-02T08:15:23.000Z %{host} %{message}], :response=\>{"index"=\>{"\_index"=\>"erinapplog-2017.03.02", "\_type"=\>"erinapplog", "\_id"=\>"4086972", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [OccurredDate]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Invalid format: "3/2/2017 8:15:23 AM" is malformed at "/2/2017 8:15:23 AM""}}}}}

date fliter는 아래와 같이 설정하였습니다.

date {  
match =\> ["OccurredDate", "YYYY-MM-dd'T'HH:mm:ss","YYYY-MM-dd'T'HH:mm:ss.SSS", "YYYY-MM-dd'T'HH:mm:ssZ","YYYY-MM-dd'T'HH:mm:ss.SSSZ", "UNIX\_MS", "UNIX", "MM/dd/YYYY HH:mm:ss aa", "M/d/YYYY H:mm:ss aa", "ISO8601"]  
timezone =\> "Etc/UCT"  
target =\> "@timestamp"

}

뭔가 경험이 있으신 분들이 계신가요?

미리 감사합니다. 🙂

---

<div class="post-metadata">

**Author:** ![kimjmin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kimjmin/32/15223_2.png) [@kimjmin](https://discuss.elastic.co/u/kimjmin)\
**Post date:** [March 23, 2017, 8:38am UTC](https://discuss.elastic.co/t/logstash-date-invalid-format/77112/2 "2017-03-23T08:38:50Z")

</div>

다른 쓰레드에서 같은 답변 드렸는데 ES 매핑에서 한번 설정 해 보시기 바랍니다.

> [@Logstash date 파싱 중](https://discuss.elastic.co/t/logstash-date/78631/2):
>
> 안녕하세요. 보통은 ES 매핑에서 date 필드에 형식을 적용 해 주면 되는걸로 알고 있는데 [https://www.elastic.co/guide/en/elasticsearch/reference/5.2/mapping-date-format.html#strict-date-time](https://www.elastic.co/guide/en/elasticsearch/reference/5.2/mapping-date-format.html#strict-date-time) yyyy-MM-dd hh:mm:ss a 위 형식으로 하면 되지 않을까 싶습니다. joda time format 도큐먼트도 한번 참고 해 보세요. [http://www.joda.org/joda-time/apidocs/org/joda/time/format/DateTimeFormat.html](http://www.joda.org/joda-time/apidocs/org/joda/time/format/DateTimeFormat.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2017, 8:39am UTC](https://discuss.elastic.co/t/logstash-date-invalid-format/77112/3 "2017-04-20T08:39:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.