# Logstash doesn't recognize "Feb 29" as a valid date

**URL:** https://discuss.elastic.co/t/logstash-doesnt-recognize-feb-29-as-a-valid-date/42965
**Category:** Logstash
**Created:** [February 29, 2016, 4:52am UTC](https://discuss.elastic.co/t/logstash-doesnt-recognize-feb-29-as-a-valid-date/42965 "2016-02-29T04:52:13Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![s0mb00n](https://avatars.discourse-cdn.com/v4/letter/s/7c8e57/32.png) [@s0mb00n](https://discuss.elastic.co/u/s0mb00n)
#### Post date: [February 29, 2016, 4:52am UTC](https://discuss.elastic.co/t/logstash-doesnt-recognize-feb-29-as-a-valid-date/42965/1 "2016-02-29T04:52:13Z")

</div>

Logstash continuously output the following error when the clock hit February 29th, 2016:

* * *

> {"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [timestamp]", "caused\_by"=\>{"type"=\>"illegal\_field\_value\_exception", "reason"=\>"Cannot parse "Feb 29 00:17:01": Value 29 for dayOfMonth must be in the range [1,28]"}}}}, :level=\>:warn}

* * *

This is causing my logstash/elasticsearch host to run out of space as the log files grew out of control.

Is there a workaround for this? Can I configure logstash and elasticsearch to ignore this error message?

Best Regards,

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 29, 2016, 5:05am UTC](https://discuss.elastic.co/t/logstash-doesnt-recognize-feb-29-as-a-valid-date/42965/2 "2016-02-29T05:05:36Z")

</div>

Does your message have a year in the date?  
If not use something like this to add it in;

```auto
filter {
  mutate {
    replace => ["timestamp", "%{timestamp} 2016"]
  }
  date {
    locale => "en"
    match => ["timestamp", "MMM d HH:mm:ss YYYY", "MMM dd HH:mm:ss YYYY", "ISO8601"]
  }
}

```

---

<div class="post-metadata">

### Author: ![s0mb00n](https://avatars.discourse-cdn.com/v4/letter/s/7c8e57/32.png) [@s0mb00n](https://discuss.elastic.co/u/s0mb00n)
#### Post date: [March 1, 2016, 2:50am UTC](https://discuss.elastic.co/t/logstash-doesnt-recognize-feb-29-as-a-valid-date/42965/3 "2016-03-01T02:50:58Z")

</div>

Thanks for your help @warkolm. After I updated my logstash config file per your suggestion, I'm no longer seeing the erro 'Value 29...". However, I'm now seeing a ton of these errors in my Elasticsearch log:

> Mar 1 02:44:13 logstash elasticsearch[20315]: MapperParsingException[failed to parse [timestamp]]; nested: IllegalArgumentException[Invalid format: "Feb 29 22:29:16 2016" is malformed at " 2016"];

I have update my `elasticsearch-template.json` file so that the ` timestamp` field now has the following entry:

> ```
> "timestamp" : {
> "type" : "date",
> "format" : "epoch_millis||dateOptionalTime||MMM dd HH:mm:ss||dd/MMM/YYYY:HH:mm:ss Z||yyyy/MM/dd HH:mm:ss||yyyy/MM/dd||MMM d HH:mm:ss yyyy||MMM dd HH:mm:ss yyyy"
> },
> 
> ```

but it doesn't look like it helps.

Any idea how I can get rid of the error in Elasticsearch?

Thanks,

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:09am UTC](https://discuss.elastic.co/t/logstash-doesnt-recognize-feb-29-as-a-valid-date/42965/4 "2017-07-06T05:09:14Z")

</div>