# Suricata timestamp problem
**URL:** https://discuss.elastic.co/t/suricata-timestamp-problem/57037
**Category:** Logstash
**Created:** [August 2, 2016, 4:30pm UTC](https://discuss.elastic.co/t/suricata-timestamp-problem/57037 "2016-08-02T16:30:31Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Slydder](https://discuss.elastic.co/u/Slydder)
#### Post date: [August 2, 2016, 4:30pm UTC](https://discuss.elastic.co/t/suricata-timestamp-problem/57037/1 "2016-08-02T16:30:31Z")
Hey all,
I am sendling suricata json to logstash and logstash is having problems with the timestamp format:
{:timestamp=\>"2016-08-02T18:28:37.516000+0200", :message=\>"Failed parsing date from field", :field=\>"timestamp", :value=\>"2016-08-02T18:28:36.001531+0200", :exception=\>"Invalid format: "2016-08-02T18:28:36.001531+0200" is malformed at "-08-02T18:28:36.001531+0200"", :config\_parsers=\>"YYYY MMM dd HH:mm:ss", :config\_locale=\>"default=en\_US", :level=\>:warn}
my logstash config for suricata is as follows (just added the timezone option as a last ditch effort which didn't work):
input {
file {
path =\> ["/var/log/suricata/eve.json"]
sincedb\_path =\> ["/var/lib/logstash/sincedb"]
codec =\> json
type =\> "SuricataIDPS"
}
}
filter {
if [type] == "SuricataIDPS" {
date {
match =\> ["timestamp", "yyyy-MM-dd'T'HH:mm:ss.SSS"]
timezone =\> "Europe/Berlin"
}
ruby {
code =\> "if event['event\_type'] == 'fileinfo'; event['fileinfo']['type']=event['fileinfo']['magic'].to\_s.split(',')[0]; end;"
}
}
if [src\_ip] {
geoip {
source =\> "src\_ip"
target =\> "geoip"
#database =\> "/opt/logstash/vendor/geoip/GeoLiteCity.dat"
add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
convert =\> ["[geoip][coordinates]", "float" ]
}
if ![geoip.ip] {
if [dest\_ip] {
geoip {
source =\> "dest\_ip"
target =\> "geoip"
#database =\> "/opt/logstash/vendor/geoip/GeoLiteCity.dat"
add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
convert =\> ["[geoip][coordinates]", "float" ]
}
}
}
}
}
output {
elasticsearch {
hosts =\> ["localhost:9200"]
#protocol =\> http
}
}
Thanks for the help,
Chuck
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 3, 2016, 6:11am UTC](https://discuss.elastic.co/t/suricata-timestamp-problem/57037/2 "2016-08-03T06:11:20Z")
> [@Slydder](#):
>
> HH:mm:ss.SSS
Does not match;
> [@Slydder](#):
>
> 18:28:36.001531
You may want to add more `S`.
---
### Author:  [@Slydder](https://discuss.elastic.co/u/Slydder)
#### Post date: [August 3, 2016, 7:34am UTC](https://discuss.elastic.co/t/suricata-timestamp-problem/57037/3 "2016-08-03T07:34:41Z")
Sorry,
forgot to mention I also tried the following
yyyy-MM-dd'T'HH:mm:ss.SSSSSS
yyyy-MM-dd'T'HH:mm:ss.SSSZ
yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ
All to no avail. but what I am wondering about mostly is the:
config\_parsers=\>"YYYY MMM dd HH:mm:ss"
entry in the logstash log. This entry looks NOTHING like what I am trying to match with and am not sure why it is even listed.
---
### Author:  [@Slydder](https://discuss.elastic.co/u/Slydder)
#### Post date: [August 3, 2016, 9:44am UTC](https://discuss.elastic.co/t/suricata-timestamp-problem/57037/4 "2016-08-03T09:44:22Z")
So,
After testing everything by starting logstash with only the suricata config and accepting input from stdin then piping the contents of the json log into logstash I can verify that the suricata config is correct using the match
```
match => ["timestamp", "YYYY-MM-dd'T'HH:mm:ss.SSSSSSZ"]
```
There is a problem when starting with the normal config and including the suricata config where logstash tries to match against another pattern instead of the pattern in the suricata config even though the type is set to suricata when reading in the json logs.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:45am UTC](https://discuss.elastic.co/t/suricata-timestamp-problem/57037/5 "2017-07-06T04:45:07Z")