# Logstash Parsing error for time field in correct JSON
**URL:** https://discuss.elastic.co/t/logstash-parsing-error-for-time-field-in-correct-json/199537
**Category:** Logstash
**Created:** [September 15, 2019, 2:54pm UTC](https://discuss.elastic.co/t/logstash-parsing-error-for-time-field-in-correct-json/199537 "2019-09-15T14:54:48Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@aleksei.saiko](https://discuss.elastic.co/u/aleksei.saiko)
#### Post date: [September 15, 2019, 2:54pm UTC](https://discuss.elastic.co/t/logstash-parsing-error-for-time-field-in-correct-json/199537/1 "2019-09-15T14:54:48Z")
Hey guys!
I'm receiving Logstash parsing error for this JSON -
```auto
{
"time_date": "2019-09-11T07:05:32+00:00",
"client": "22.222.2.222",
"host": "xxxx.com",
"scheme": "https",
"request_method": "GET",
"request_uri": "/rd/",
"request_id": "f44d35bcf367be11c2804fd2f7d2dd41",
"status": 499,
"upstream_addr": "111.11.111.111:80",
"-": -1,
"request_time": 0.295,
"upstream_response_time": 0.296,
"upstream_connect_time": 0.004,
"upstream_header_time": -1
}
```
Which is correct JSON.
The error is -
```auto
controller.go:276] Endpoints logstash-kube changed, syncing"; line: 1, column: 7]>}
2019-09-11T09:49:06.908134227Z [2019-09-11T09:49:06,907][WARN][logstash.filters.json] Error parsing json {:source=>"message", :raw=>"I0911 09:48:20.464574 1 controller.go:276]
```
That means, that it can't parse the date - raw=\>"I0911.
Here is the Logstash config
```auto
apiVersion: v1
kind: ConfigMap
metadata:
name: logstash-kube-config
data:
logstash.conf: |-
input {
beats {
port => 5044
}
}
filter {
if [kubernetes][container][name] == "nginx-ingress" {
json {
source => "message"
}
}
else if [kubernetes][container][name] == "nginx" {
grok {
match => {
"message" => "%{IP:remote_ip} - \[%{HTTPDATE:[response][time]}\] \"%{DATA:url}\" %{NUMBER:[response][code]} %{NUMBER:[response][bytes]} %{QS:user_agent}"
}
remove_field => "message"
}
geoip {
source => "remote_ip"
target => "[geoip]"
}
}
else {
drop {}
}
date {
match => ["time", "ISO8601"]
remove_field => ["time"]
}
mutate {
remove_field => ["source", "host", "[beat][name]", "[beat][version]"]
}
}
output {
elasticsearch {
hosts => ["http://yyyy-xxxx-67284-dal10.lb.xxx.net:9200"]
index => "apps-prod-dal10-%{[kubernetes][namespace]}-deployment-%{[kubernetes][container][name]}-%{[kubernetes][replicaset][name]}%{+YYYY.MM.dd}"
}
}
```
What am I doing wrong here?
---
### Author:  [@Aimee470](https://discuss.elastic.co/u/Aimee470)
#### Post date: [September 16, 2019, 4:27am UTC](https://discuss.elastic.co/t/logstash-parsing-error-for-time-field-in-correct-json/199537/2 "2019-09-16T04:27:47Z")
I can not understand the second code.
---
### Author:  [@aleksei.saiko](https://discuss.elastic.co/u/aleksei.saiko)
#### Post date: [September 16, 2019, 6:58am UTC](https://discuss.elastic.co/t/logstash-parsing-error-for-time-field-in-correct-json/199537/3 "2019-09-16T06:58:00Z")
It's an Logstash logs
---
### Author:  [@Aimee470](https://discuss.elastic.co/u/Aimee470)
#### Post date: [September 17, 2019, 6:16am UTC](https://discuss.elastic.co/t/logstash-parsing-error-for-time-field-in-correct-json/199537/4 "2019-09-17T06:16:00Z")
Got it[.](https://www.ishowbox.vip/)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 15, 2019, 6:16am UTC](https://discuss.elastic.co/t/logstash-parsing-error-for-time-field-in-correct-json/199537/5 "2019-10-15T06:16:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.