# Logstash date not matching

**URL:** <https://discuss.elastic.co/t/logstash-date-not-matching/207266>\
**Category:** Logstash\
**Created:** [November 11, 2019, 4:10am UTC](https://discuss.elastic.co/t/logstash-date-not-matching/207266 "2019-11-11T04:10:15Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![VamPikmin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vampikmin/32/22367_2.png) [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\
**Post date:** [November 11, 2019, 4:10am UTC](https://discuss.elastic.co/t/logstash-date-not-matching/207266/1 "2019-11-11T04:10:15Z")

</div>

Hey all,  
I'm trying to work out why I get a grok parse failure on date here when using these two as input

2014-10-05 02:59:25 Works  
2015-10-05 02:59:25 Does not work

timestamp.conf

```
   input {
        stdin { }
    }

    filter {
     grok {
        match => { "message" => "%{TIMESTAMP_ISO8601:logdate}" }
     }}

filter {
	date {
	match => ["logdate", "yyyy-MM-dd HH:mm:ss"]
	target => "@timestamp"
}}
output {
    stdout { codec => rubydebug }
}

```

./logstash -f timestamp.conf -e

Not Working

```
2014-10-05 02:59:25
{
      "@version" => "1",
          "host" => "elastic18",
       "logdate" => "2014-10-05 02:59:25",
          "tags" => [
        [0] "_dateparsefailure"
    ],
       "message" => "2014-10-05 02:59:25",
    "@timestamp" => 2019-11-11T04:07:37.236Z
}

```

Working

```
2015-10-05 02:59:25
{
      "@version" => "1",
          "host" => "elastic18",
    "@timestamp" => 2015-10-04T15:59:25.000Z,
       "logdate" => "2015-10-05 02:59:25",
       "message" => "2015-10-05 02:59:25"
}

```

Thank you

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 11, 2019, 1:59pm UTC](https://discuss.elastic.co/t/logstash-date-not-matching/207266/2 "2019-11-11T13:59:08Z")

</div>

Under your local DST rules are you sure that 2015-10-05 02:59:25 existed?

---

<div class="post-metadata">

**Author:** ![VamPikmin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vampikmin/32/22367_2.png) [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\
**Post date:** [November 11, 2019, 11:16pm UTC](https://discuss.elastic.co/t/logstash-date-not-matching/207266/3 "2019-11-11T23:16:29Z")

</div>

@Badger

Sorry I don't understand what you mean by DST rules, are you talking about the ELK server?

My ELK server runs on Linux and the timezone is set to Australia/Melbourne

```
zdump -v Australia/Melbourne | grep 2015
Australia/Melbourne Sat Apr 4 15:59:59 2015 UT = Sun Apr 5 02:59:59 2015 AEDT isdst=1 gmtoff=39600
Australia/Melbourne Sat Apr 4 16:00:00 2015 UT = Sun Apr 5 02:00:00 2015 AEST isdst=0 gmtoff=36000
Australia/Melbourne Sat Oct 3 15:59:59 2015 UT = Sun Oct 4 01:59:59 2015 AEST isdst=0 gmtoff=36000
Australia/Melbourne Sat Oct 3 16:00:00 2015 UT = Sun Oct 4 03:00:00 2015 AEDT isdst=1 gmtoff=39600

```

If I change the date filter timezone to +10 instead of Australia/Melbourne, it seems to be working fine but its out by an hour

```
logdate	2019-11-11 23:14:40
@timestamp	Nov 12, 2019 @ 00:14:40.000

```

EDIT: temporary brain freeze, It should be +11 😊

I still don't understand why the original timezone doesn't work

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 12, 2019, 2:08am UTC](https://discuss.elastic.co/t/logstash-date-not-matching/207266/4 "2019-11-12T02:08:32Z")

</div>

No, it is not an ELK thing. DST is about the time suddenly jumping from 2:00 to 3:00 (meaning 2:59 does not exist) once in spring and then backwards in the autumn (so 2:01 happens twice, an hour apart). Right now I just feel too lazy to work out if clocks go back or forward in the Southern hemisphere in the Autumn.

---

<div class="post-metadata">

**Author:** ![VamPikmin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vampikmin/32/22367_2.png) [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\
**Post date:** [November 12, 2019, 3:49am UTC](https://discuss.elastic.co/t/logstash-date-not-matching/207266/5 "2019-11-12T03:49:26Z")

</div>

Thanks for the insight

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 10, 2019, 3:49am UTC](https://discuss.elastic.co/t/logstash-date-not-matching/207266/6 "2019-12-10T03:49:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.