# Logstash Illegal Argument Exception while parsing date **URL:** \ **Category:** Logstash\ **Created:** [April 25, 2022, 9:46am UTC](https://discuss.elastic.co/t/logstash-illegal-argument-exception-while-parsing-date/303142 "2022-04-25T09:46:54Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![b.ohmer](https://avatars.discourse-cdn.com/v4/letter/b/ee59a6/32.png) [@b.ohmer](https://discuss.elastic.co/u/b.ohmer)\ **Post date:** [April 25, 2022, 9:46am UTC](https://discuss.elastic.co/t/logstash-illegal-argument-exception-while-parsing-date/303142/1 "2022-04-25T09:46:54Z")
Hi there, I've got three questions around Logstash: 1. We're using an older version of Logstash (6.5.4) and experiencing currently an issue while parsing a date. I've got absolutely no idea anymore what I can do to make it work. This is the exception: ```auto [2022-04-25T09:32:54,248][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"webtools-dev-2022.04.25", :_type=>"doc", :routing=>nil}, #], :response=>{"index"=>{"_index"=>"webtools-dev-2022.04.25", "_type"=>"doc", "_id"=>"5usRYIABZkNlZjpwFuFa", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [log_timestamp] of type [date]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"2022-04-25 09:32:41.847\" is malformed at \" 09:32:41.847\""}}}}} [2022-04-25T09:32:54,248][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"webtools-dev-2022.04.25", :_type=>"doc", :routing=>nil}, #], :response=>{"index"=>{"_index"=>"webtools-dev-2022.04.25", "_type"=>"doc", "_id"=>"5-sRYIABZkNlZjpwFuFa", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [log_timestamp] of type [date]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"09:32:46.822\" is malformed at \":32:46.822\""}}}}} ``` This is our date parsing part: ```auto date { match => ["log_timestamp", "ISO8601", "MMM dd, yyyy HH:mm:ss a", "yyyy-MM-dd HH:mm:ss.SSS", "yyyy-MM-dd HH:mm:ss,SSS", "HH:mm:ss.SSS", "dd-MMM-yyyy HH:mm:ss.SSS"] timezone => "Europe/Berlin" target => "@timestamp" } ``` If I use log\_timestamp - the originating field - as target it funnily works, but if I use `@timestamp` it throws the exception above. I'm pretty much sure our parse expressions are correct. We need different expressions because unfortunately the input expressions are not very streamlined yet. 1. Furthermore I'm also wondering how I can add the current day to a timestamp that only exists of the time. 2. I found a `@time` field in the index and don't know where it originates from. Is that a field Filebeat adds by default somehow? It's exactly the log line timestamp and maybe I can just use that field instead parsing the expression then. Thanks Bastian ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 25, 2022, 5:40pm UTC](https://discuss.elastic.co/t/logstash-illegal-argument-exception-while-parsing-date/303142/2 "2022-04-25T17:40:11Z")
> [@b.ohmer](#): > > If I use log\_timestamp - the originating field - as target it funnily works, but if I use `@timestamp` it throws the exception above. That makes sense. elasticsearch is complaining about the format of the [log\_timestamp] field, so if you overwrite it with the output of a date filter that may well enable elasticsearch to parse it. You need to [review the mapping](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-get-mapping.html) for the index. The date parsers are listed [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html). It may be your index is configured to expect [log\_timestamp] to be a basic\_date rather than a strict\_date\_optional\_time. ---
**Author:** ![b.ohmer](https://avatars.discourse-cdn.com/v4/letter/b/ee59a6/32.png) [@b.ohmer](https://discuss.elastic.co/u/b.ohmer)\ **Post date:** [April 26, 2022, 6:15am UTC](https://discuss.elastic.co/t/logstash-illegal-argument-exception-while-parsing-date/303142/3 "2022-04-26T06:15:44Z")
I see, thanks for the pointer. I've seen that log\_timestamp is a string, which makes sense that it's working then. What I actually want to achieve is to parse this field and get the parsed value into @timestamp which is of type `date`, simply `date` with no additional format specificers or so. I'm sorry but I still don't understand what the issue is, especially for the first exception line. I get that it might throw an exception for timestamp only when expecting a full fledged date. We have the same mapping in other indexes and there it seems to work...type `date` showing a date and a time with no additional format definition in the mapping. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 26, 2022, 5:00pm UTC](https://discuss.elastic.co/t/logstash-illegal-argument-exception-while-parsing-date/303142/4 "2022-04-26T17:00:40Z")
What is the mapping of the field that the exception occurs for? ---
**Author:** ![b.ohmer](https://avatars.discourse-cdn.com/v4/letter/b/ee59a6/32.png) [@b.ohmer](https://discuss.elastic.co/u/b.ohmer)\ **Post date:** [May 10, 2022, 12:50pm UTC](https://discuss.elastic.co/t/logstash-illegal-argument-exception-while-parsing-date/303142/5 "2022-05-10T12:50:07Z")
Sorry for the late reply. ```auto "@timestamp" : { "type" : "date" }, "log_timestamp" : { "type" : "date" }, ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 10, 2022, 4:24pm UTC](https://discuss.elastic.co/t/logstash-illegal-argument-exception-while-parsing-date/303142/6 "2022-05-10T16:24:04Z")
> [@b.ohmer](#): > > ```auto > "log_timestamp" : { > "type" : "date" > }, > > ``` Hard to say why that would produce this warning. The default format for a field of type "date" is "strict\_date\_optional\_time||epoch\_millis", and that should parse the values that got warnings. If your index had ``` "log_timestamp" : { "type" : "date", "format": "yyyy-MM-dd" }, ``` then I would expect the warnings you showed. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 7, 2022, 4:24pm UTC](https://discuss.elastic.co/t/logstash-illegal-argument-exception-while-parsing-date/303142/7 "2022-06-07T16:24:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.