# Logstash date parser not parsing correctly

**URL:** <https://discuss.elastic.co/t/logstash-date-parser-not-parsing-correctly/64227>\
**Category:** Logstash\
**Created:** [October 28, 2016, 2:02am UTC](https://discuss.elastic.co/t/logstash-date-parser-not-parsing-correctly/64227 "2016-10-28T02:02:50Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\
**Post date:** [October 28, 2016, 2:02am UTC](https://discuss.elastic.co/t/logstash-date-parser-not-parsing-correctly/64227/1 "2016-10-28T02:02:50Z")

</div>

I am using logstash for parsing events but having problem with the date parser.

My environment is below.

```
[root@elk-analytic logstash]# rpm -qi logstash
Name : logstash
Epoch : 1
Version : 5.0.0
Release : 1
Architecture: noarch
Install Date: Thu 27 Oct 2016 01:26:03 PM JST
Group : default
Size : 198320729
License : ASL 2.0
Signature : RSA/SHA512, Wed 26 Oct 2016 01:57:59 PM JST, Key ID d27d666cd88e42b4
Source RPM : logstash-5.0.0-1.src.rpm
Build Date : Wed 26 Oct 2016 01:10:26 PM JST
Build Host : packer-virtualbox-iso-1474648640
Relocations : /
Packager : <vagrant@packer-virtualbox-iso-1474648640>
Vendor : Elasticsearch
URL : http://www.elasticsearch.org/overview/logstash/
Summary : An extensible logging pipeline
Description :

```

I an using date parser to set the @timestamp but it is not parsing the one digit hour correctly.

`[2016-10-28T11:00:10,233][WARN][logstash.filters.date] Failed parsing date from field {:field=>"report_datetime", :value=>"20160204 935", :exception=>"Cannot parse \"20160204 935\": Value 93 for hourOfDay must be in the range [0,23]", :config_parsers=>"YYYYMMdd Hmm", :config_locale=>"default=en_US"}`

[Document](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-match) says one H should parse one digit hour but it is not.

> H

> hour of the day (24-hour clock)

> H  
> minimal-digit hour. Example: 0 for midnight.  
> HH  
> two-digit hour, zero-padded if needed. Example: 00 for midnight.

Am I setting the match wrong?

---

<div class="post-metadata">

**Author:** ![sabyasachi\_mallick](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@sabyasachi\_mallick](https://discuss.elastic.co/u/sabyasachi_mallick)\
**Post date:** [October 28, 2016, 9:47am UTC](https://discuss.elastic.co/t/logstash-date-parser-not-parsing-correctly/64227/2 "2016-10-28T09:47:48Z")

</div>

one H won't parse a datetime. You should use something like this .

date {  
match =\> ["field name", "MM YYYYHH:mm:ss"]  
target =\> "field name"  
}

---

<div class="post-metadata">

**Author:** ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\
**Post date:** [October 28, 2016, 11:03pm UTC](https://discuss.elastic.co/t/logstash-date-parser-not-parsing-correctly/64227/3 "2016-10-28T23:03:19Z")

</div>

Do you mean you write to H and will parse both one and two digits?  
Document clearly describes one H is available.

`Here’s what you can use to parse dates and times:`

---

<div class="post-metadata">

**Author:** ![sabyasachi\_mallick](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@sabyasachi\_mallick](https://discuss.elastic.co/u/sabyasachi_mallick)\
**Post date:** [October 29, 2016, 5:32am UTC](https://discuss.elastic.co/t/logstash-date-parser-not-parsing-correctly/64227/4 "2016-10-29T05:32:31Z")

</div>

yes, you have to write HH to parse a two digit hour starting with 0.

single H is for minimal digit hour , that means if only 7 is there then it ll parse , if 07 is there it won't. That means it ll parse 0-24 but not starting with 0.

HH means it ll parse two digits.

---

<div class="post-metadata">

**Author:** ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\
**Post date:** [November 1, 2016, 11:50pm UTC](https://discuss.elastic.co/t/logstash-date-parser-not-parsing-correctly/64227/5 "2016-11-01T23:50:45Z")

</div>

Its not a complete **two digit hour**. It is two digit hour with minimum of one digit hour.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:31am UTC](https://discuss.elastic.co/t/logstash-date-parser-not-parsing-correctly/64227/6 "2017-07-06T04:31:39Z")

</div>