# Need Help parsing timestamps

**URL:** <https://discuss.elastic.co/t/need-help-parsing-timestamps/134988>\
**Category:** Logstash\
**Created:** [June 7, 2018, 12:50pm UTC](https://discuss.elastic.co/t/need-help-parsing-timestamps/134988 "2018-06-07T12:50:23Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mugen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mugen/32/16454_2.png) [@Mugen](https://discuss.elastic.co/u/Mugen)\
**Post date:** [June 7, 2018, 12:50pm UTC](https://discuss.elastic.co/t/need-help-parsing-timestamps/134988/1 "2018-06-07T12:50:23Z")

</div>

I am curently parsing azure messages. Sadly azure sends some dates in the following format:

> 2018-06-03 01:00:12Z

at first I thought this would be a normal ISO8601 but this did not match. I tried a Formats like `yyyy-MM-dd HH:mm:ssZ` and `yyyy-MM-dd HH:mm:ss` but this did not work also. Do I have to remove the Z at the end of the Azure timestamp?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 7, 2018, 1:25pm UTC](https://discuss.elastic.co/t/need-help-parsing-timestamps/134988/2 "2018-06-07T13:25:17Z")

</div>

For non-formatting syntax, you’ll need to put single-quote characters around the value.

```
date { match => { "someField", "yyyy-MM-dd HH:mm:ss'Z'" } }
```

---

<div class="post-metadata">

**Author:** ![Mugen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mugen/32/16454_2.png) [@Mugen](https://discuss.elastic.co/u/Mugen)\
**Post date:** [June 12, 2018, 7:33am UTC](https://discuss.elastic.co/t/need-help-parsing-timestamps/134988/3 "2018-06-12T07:33:37Z")

</div>

Even with the single quoted Z the error persists.

> date {  
> match =\> ["[records][properties][eventProperties][Start Time]", "yyyy-MM-dd HH:mm:ss'Z'" ]  
> }

> [records.properties.eventProperties.Start Time]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Invalid format: "2018-06-03 01:00:12Z" is malformed at " 01:00:12Z""}}}}}

---

<div class="post-metadata">

**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\
**Post date:** [June 13, 2018, 5:24pm UTC](https://discuss.elastic.co/t/need-help-parsing-timestamps/134988/4 "2018-06-13T17:24:49Z")

</div>

Try Grok filter

%{TIMESTAMP\_ISO8601:DATE}

---

<div class="post-metadata">

**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\
**Post date:** [June 13, 2018, 5:26pm UTC](https://discuss.elastic.co/t/need-help-parsing-timestamps/134988/5 "2018-06-13T17:26:44Z")

</div>

Try this

date { match =\> { "someField", "yyyy-MM-dd HH:mm:ssZ" } }

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 13, 2018, 5:46pm UTC](https://discuss.elastic.co/t/need-help-parsing-timestamps/134988/6 "2018-06-13T17:46:28Z")

</div>

That's not an exception from the date filter, it's a mapper parsing exception from elasticsearch, right?

---

<div class="post-metadata">

**Author:** ![Mugen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mugen/32/16454_2.png) [@Mugen](https://discuss.elastic.co/u/Mugen)\
**Post date:** [July 3, 2018, 1:53pm UTC](https://discuss.elastic.co/t/need-help-parsing-timestamps/134988/7 "2018-07-03T13:53:28Z")

</div>

Yes this was an error by elasticsearch. I dont know why, but i tested the config and viewed the output via output on stdout and everything seemed fine with the 'Z'. For now this error hasent apeared since. I will report back to you guys if it happens again.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 3, 2018, 6:50pm UTC](https://discuss.elastic.co/t/need-help-parsing-timestamps/134988/8 "2018-07-03T18:50:53Z")

</div>

> [@Mugen](#):
>
> I dont know why

If you index a field that contains "2018-06-03" then elasticsearch expects that field to contain a date. "2018-06-03 01:00:12Z" is not a date, it is a timestamp. So it will complain about the field format all day, until it rolls to a new index, at which point it starts expecting the field to contain a timestamp. (Assuming you do not have a template forcing the field format.)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 31, 2018, 6:50pm UTC](https://discuss.elastic.co/t/need-help-parsing-timestamps/134988/9 "2018-07-31T18:50:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.