# Logstash - Filtering multiple date formats - date\_time\_parse\_exception

**URL:** <https://discuss.elastic.co/t/logstash-filtering-multiple-date-formats-date-time-parse-exception/203725>\
**Category:** Logstash\
**Created:** [October 15, 2019, 11:48pm UTC](https://discuss.elastic.co/t/logstash-filtering-multiple-date-formats-date-time-parse-exception/203725 "2019-10-15T23:48:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sidharth\_Sinha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sidharth_sinha/32/46287_2.png) [@Sidharth\_Sinha](https://discuss.elastic.co/u/Sidharth_Sinha)\
**Post date:** [October 15, 2019, 11:48pm UTC](https://discuss.elastic.co/t/logstash-filtering-multiple-date-formats-date-time-parse-exception/203725/1 "2019-10-15T23:48:14Z")

</div>

I have a stream of json logs being sent into elastic via logstash.  
The input stream has inconsistent date formats, in one of the either formats:

`"YYYY-MM-dd'T'HH:mm:ssZ", or "YYYY-MM-dd HH:mm:ss"`

Example, some of them are of this format:

```
  "started": "2019-10-14T07:54:00-07:00",
  "finished": "2019-10-14T07:54:30-07:00",

```

And some of them are of this format:

```
  "started": "2019-10-14 16:06:39",
  "finished": "2019-10-14 16:07:18",

```

I wrote this filter to match both:

```
  date {
    match => ["datestart", "YYYY-MM-dd'T'HH:mm:ssZ", "YYYY-MM-dd HH:mm:ss"]
  }

```

Which I thought should match both, but I get this error for the second format, when I start logstash.

"reason"=\>"failed to parse date field [2019-10-14 16:06:39] with format [strict\_date\_optional\_time||epoch\_millis]", "caused\_by"=\>{"type"=\>"date\_time\_parse\_exception", "reason"=\>"Failed to parse with all enclosed parsers"}}}}}}

Any suggestions?

I am exploring cutting off the timezone using grok as it doesnt really matter for my case, but it would be much easier if I could just handle both.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 12, 2019, 11:48pm UTC](https://discuss.elastic.co/t/logstash-filtering-multiple-date-formats-date-time-parse-exception/203725/2 "2019-11-12T23:48:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.