# Malformed dateformat

**URL:** <https://discuss.elastic.co/t/malformed-dateformat/62234>\
**Category:** Logstash\
**Created:** [October 5, 2016, 5:47am UTC](https://discuss.elastic.co/t/malformed-dateformat/62234 "2016-10-05T05:47:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pbmsys](https://avatars.discourse-cdn.com/v4/letter/p/57b2e6/32.png) [@pbmsys](https://discuss.elastic.co/u/pbmsys)\
**Post date:** [October 5, 2016, 5:47am UTC](https://discuss.elastic.co/t/malformed-dateformat/62234/1 "2016-10-05T05:47:10Z")

</div>

Hi.

We are seeing errors on malformed dateformats on our Logstash hosts even though we should be matching the pattern.  
Logstash: 2.4  
Elasticsearch: 2.4

**The Logstash Config:**

> if [message] {  
> grok {  
> patterns\_dir =\> ["/etc/logstash/patterns/grok-patterns"]  
> #Wildfly PHP Apache  
> match =\> { "message" =\> ["\A%{TIMESTAMP\_ISO8601:logdate}",  
> "%{PHP\_TIMESTAMP:logdate}",  
> "%{HTTPDATE:logdate}"]  
> }  
> }  
> }  
> date {  
> match =\> ["logdate", "ISO8601", "yyyy/MM/dd HH:mm:ss", "dd-MMM-yyyy HH:mm:ss ZZZ", "dd/MMM/yyyy:HH:mm:ss Z"]  
> add\_tag =\> ["date\_modified"]  
> }

**The error data:**

> {:timestamp=\>"2016-10-05T04:27:02.179000+0200", :message=\>"Failed parsing date from field", :field=\>"logdate", :value=\>"2016-10-05 04:26:54", :exception=\>"Invalid format: "2016-10-05 04:26:54" is malformed at "16-10-05 04:26:54"", :config\_parsers=\>"ISO8601,yyyy/MM/dd HH:mm:ss,dd-MMM-yyyy HH:mm:ss ZZZ,dd/MMM/yyyy:HH:mm:ss Z", :config\_locale=\>"default=en\_US", :level=\>:warn}

Have anyone experienced the same?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 5, 2016, 6:15am UTC](https://discuss.elastic.co/t/malformed-dateformat/62234/2 "2016-10-05T06:15:50Z")

</div>

It seems the ISO8601 date pattern requires milliseconds. Either tack on ",000" at the end of `logdate` or add a new pattern based on the ones below but without the ".SSS" suffix.

> <https://github.com/logstash-plugins/logstash-filter-date/blob/v3.0.3/lib/logstash/filters/date.rb#L236-L241>

---

<div class="post-metadata">

**Author:** ![pbmsys](https://avatars.discourse-cdn.com/v4/letter/p/57b2e6/32.png) [@pbmsys](https://discuss.elastic.co/u/pbmsys)\
**Post date:** [October 5, 2016, 7:33am UTC](https://discuss.elastic.co/t/malformed-dateformat/62234/3 "2016-10-05T07:33:36Z")

</div>

@magnusbaeck

Of course we just needed to add "yyyy-MM-dd HH:mm:ss" instead of "yyyy/MM/dd HH:mm:ss"

Thank you.  
/Peter

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:35am UTC](https://discuss.elastic.co/t/malformed-dateformat/62234/4 "2017-07-06T04:35:45Z")

</div>