# Logstash Date Parsing Error - How to Address

**URL:** <https://discuss.elastic.co/t/logstash-date-parsing-error-how-to-address/187660>\
**Category:** Logstash\
**Created:** [June 26, 2019, 7:21pm UTC](https://discuss.elastic.co/t/logstash-date-parsing-error-how-to-address/187660 "2019-06-26T19:21:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![thadc](https://avatars.discourse-cdn.com/v4/letter/t/7cd45c/32.png) [@thadc](https://discuss.elastic.co/u/thadc)\
**Post date:** [June 26, 2019, 7:21pm UTC](https://discuss.elastic.co/t/logstash-date-parsing-error-how-to-address/187660/1 "2019-06-26T19:21:01Z")

</div>

Hello,

I had a situation where some of our indexes were not being discovered in kibana. The problem turned out to be that grok parser was using %{TIMESTAMP\_ISO8601:logDateTime} for log timestamp field, and kibana required %{TIMESTAMP\_ISO8601:logTimestamp}. Once I changed this some of the additional indices were being discovered.

However, another type were not because I was getting a \_dataparsefailure in logstash on the corresponding messages incoming from filebeat.

I examined what was different between the working timestamp and the failing timestamp:

A working timestamp: 2019-05-02 22:08:30.022  
A failing timestamp: 2019-05-02 22:08:30

I did a test to make the corresponding input file (input file to filebeat) have the identical format as the ones there were working. My problem went away.

Here is my question. Why does this difference (logDateTime versus logTimestamp) even matter? Isn't this part of the field in the grok filter just a label?

Thanks for any insights!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 26, 2019, 8:19pm UTC](https://discuss.elastic.co/t/logstash-date-parsing-error-how-to-address/187660/2 "2019-06-26T20:19:39Z")

</div>

logTimestamp vs. logDateTime is just a label. But elasticsearch has expectations about what the format of a field is. If the [mapping](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-get-mapping.html) is configured to expect milliseconds on logTimestamp then it may refuse to index a document that does not have milliseconds. This will show up in the logstash log as a mapping exception.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 24, 2019, 8:19pm UTC](https://discuss.elastic.co/t/logstash-date-parsing-error-how-to-address/187660/3 "2019-07-24T20:19:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.