# Stumped on TIMESTAMP\_ISO8601 in grok

**URL:** <https://discuss.elastic.co/t/stumped-on-timestamp-iso8601-in-grok/57733>\
**Category:** Logstash\
**Created:** [August 10, 2016, 5:53pm UTC](https://discuss.elastic.co/t/stumped-on-timestamp-iso8601-in-grok/57733 "2016-08-10T17:53:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ron\_Pritchett](https://avatars.discourse-cdn.com/v4/letter/r/c67d28/32.png) [@Ron\_Pritchett](https://discuss.elastic.co/u/Ron_Pritchett)\
**Post date:** [August 10, 2016, 5:53pm UTC](https://discuss.elastic.co/t/stumped-on-timestamp-iso8601-in-grok/57733/1 "2016-08-10T17:53:37Z")

</div>

Hello,

I'm not sure why this is throwing an error.

the input file:  
\<133\>2016-08-10T16:33:39.827713+00:00 localhost opt-log-nginx-access

the configfile:  
input {  
stdin { type =\> syslog }  
}

```
filter {
  if [type] == "syslog" {
    grok {
      match => ["message", "%{SYSLOG5424PRI:priority}%{TIMESTAMP_ISO8601:timestamp} %{IPORHOST:myhost}"]
    }
    date { match => ["timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss", "MMM dd HH:mm:ss Z", "MMM d HH:mm:ss", "dd/MMM/yyyy:HH:mm:ss Z", "TIMESTAMP_ISO8601"] }
    mutate {
        add_field => { "imjava" => "imhere" }
        add_tag => "imatag"
    }
  }
}

output {
  stdout { codec => rubydebug }
  file { path => "/tmp/blah.txt" }
}

```

grok pattern per grok debug  
TIMESTAMP\_ISO8601 %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601\_TIMEZONE}?

grok debug says I'm good, but I get this error msg:

```
Settings: Default pipeline workers: 1
Pipeline aborted due to error {:exception=>#<LogStash::ConfigurationError: Cannot register filter date plugin. The error reported is:
  Illegal pattern component: T for pattern 'TIMESTAMP_ISO8601'>, :backtrace=>["/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-date-2.1.6/lib/logstash/filters/date.rb:297:in `setupMatcher'", "org/jruby/RubyArray.java:1613:in `each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-date-2.1.6/lib/logstash/filters/date.rb:224:in `setupMatcher'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-date-2.1.6/lib/logstash/filters/date.rb:189:in `register'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:182:in `start_workers'", "org/jruby/RubyArray.java:1613:in `each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:182:in `start_workers'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:136:in `run'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/agent.rb:473:in `start_pipeline'"], :level=>:error}
stopping pipeline {:id=>"main"}

```

important part being:  
**The error reported is: Illegal pattern component: T for pattern 'TIMESTAMP\_ISO8601'**

any ideas?

thanks!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 11, 2016, 5:49am UTC](https://discuss.elastic.co/t/stumped-on-timestamp-iso8601-in-grok/57733/2 "2016-08-11T05:49:41Z")

</div>

It's not grok that's complaining, it's date. TIMESTAMP\_ISO8601 is a grok pattern, not a date pattern. Try ISO8601 instead.

---

<div class="post-metadata">

**Author:** ![Ron\_Pritchett](https://avatars.discourse-cdn.com/v4/letter/r/c67d28/32.png) [@Ron\_Pritchett](https://discuss.elastic.co/u/Ron_Pritchett)\
**Post date:** [August 12, 2016, 3:17pm UTC](https://discuss.elastic.co/t/stumped-on-timestamp-iso8601-in-grok/57733/3 "2016-08-12T15:17:32Z")

</div>

Many thanks for that reply!

So, in my mind it'd seems only logical that date would also have the same patterns as grok from the standard library. At least those related to time & date. Would it be worth while for me to file an enhancement request on github for this?

thanks again!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 12, 2016, 4:17pm UTC](https://discuss.elastic.co/t/stumped-on-timestamp-iso8601-in-grok/57733/4 "2016-08-12T16:17:40Z")

</div>

It's not up to me, but I can see a number of problems with supporting grok patterns in the date filter. Not so much because it's technically hard but because creating a reasonable user interface without too many corner cases and contradictions could be challenging and in the end not really lead to an improvement. The Logstash team might see things differently, so filing an issue might not be in vain.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:43am UTC](https://discuss.elastic.co/t/stumped-on-timestamp-iso8601-in-grok/57733/5 "2017-07-06T04:43:37Z")

</div>