Logstash date parse failure error

Elastic Stack Logstash
#1

Hi ,

I'm getting the date parse failure error., Please help me on this

{:timestamp=>"2016-04-16T15:21:57.639000-0400", :message=>"Failed parsing date from field", :field=>"timestamp", :value=>"2016-04-16 19:21:54", :exception=>"Invalid format: "2016-04-16 19:21:54" is too short", :config_parsers=>"yyyy-MM-dd HH:mm:ss,SSS", :config_locale=>"default=en_US", :level=>:warn}

#2

Please show your config and a sample piece of data.
What version are you on?

#3

If this is an example of a date in your logfile "2016-04-16 19:21:54".
You should use this format "yyyy-MM-dd HH:mm:ss" and not "yyyy-MM-dd HH:mm:ss,SSS".
I didn't test this out but you can find all the information at this website about custom date formats.

#4

Hi,

Logstash version is logstash-2.2.4 . My sample config is

if [type] == "test" {
if [host] == "hostname" {
date {
match => ["timestamp", "yyyy-MM-dd HH:mm:ss,SSS"]
target => "@timestamp"
}

Getting like this in logstash.stdout

"timestamp" => "2016-04-16 21:26:59",
"@version" => "1",
"@timestamp" => "2016-04-16T21:26:53.325Z",
"host" => "hostanme",
"type" => "test",
"tags" => [
[0] "_dateparsefailure"

#5

If this is your sample date 2016-04-16 19:21:54
and this is your format yyyy-MM-dd HH:mm:ss,SSS
You need to delete the miliseconds (SSS) --> yyyy-MM-dd HH:mm:ss

#6