# There is no dateparsefailure in the tag,but it does not work **URL:** \ **Category:** Logstash\ **Created:** [May 8, 2018, 2:45am UTC](https://discuss.elastic.co/t/there-is-no-dateparsefailure-in-the-tag-but-it-does-not-work/130923 "2018-05-08T02:45:48Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\ **Post date:** [May 8, 2018, 2:45am UTC](https://discuss.elastic.co/t/there-is-no-dateparsefailure-in-the-tag-but-it-does-not-work/130923/1 "2018-05-08T02:45:49Z")
i have a field named "time",the format is just like "2018/05/02:08:22:23" , so i used a date filter, and the format is like following: date { match =\> ["time","yyyy/MM/dd:HH:mm:ss"] targer =\>"@timestamp" } there is no any \_dateparsefailure in tags,but the timestamp didn't change,where is the problem ---
**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\ **Post date:** [May 8, 2018, 3:08am UTC](https://discuss.elastic.co/t/there-is-no-dateparsefailure-in-the-tag-but-it-does-not-work/130923/2 "2018-05-08T03:08:15Z")
i have viewed the previous topic , but i didn't find the solution,i'll appreciate it if anyone who can help me~:grinning: ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 8, 2018, 6:05am UTC](https://discuss.elastic.co/t/there-is-no-dateparsefailure-in-the-tag-but-it-does-not-work/130923/3 "2018-05-08T06:05:26Z")
Please show an example event produced by Logstash. Use a `stdout { codec => rubydebug }` output. ---
**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\ **Post date:** [May 8, 2018, 7:55am UTC](https://discuss.elastic.co/t/there-is-no-dateparsefailure-in-the-tag-but-it-does-not-work/130923/4 "2018-05-08T07:55:49Z")
The output is as follows: { "inter\_id" =\> "134" "module" =\> "0-PPE-1" "messag" =\> "\<134\> 2018/05/08:02:06:05 GMT PH180I1-NC80LC02 0-PPE-1 : default tcp nat\_conn\_delink" "type" =\>"logs" "tags" =\>[ [0] "LC" ], "hostname" =\>"PH180I1-NC80LC02 " "@timestamp"=\>2018-05-07T18:06:05.000z, "time" =\> "2018/05/05:02:06:05" "info" =\> " default tcp nat\_conn\_delink"" } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 8, 2018, 7:57am UTC](https://discuss.elastic.co/t/there-is-no-dateparsefailure-in-the-tag-but-it-does-not-work/130923/5 "2018-05-08T07:57:25Z")
Okay. And what does the complete configuration look like? Does the date filter come after the grok filter or whatever you're using the parse the `message` field? ---
**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\ **Post date:** [May 8, 2018, 8:05am UTC](https://discuss.elastic.co/t/there-is-no-dateparsefailure-in-the-tag-but-it-does-not-work/130923/6 "2018-05-08T08:05:12Z")
of course ,the date filter is after grok, the full configuration of the filter is like: filter { grok { patterns\_dir =\> ["/etc/logstash/patterns"] match=\>["message","INT:inter\_id%{time:time} GMT %{HOSTNAME:hostname}%{URIHOST:module} :default %{event:event} %{INT:int1}:%{GREEDYDATE:info}"] } date { match =\> ["time","yyyy/MM/dd:HH:mm:ss"] target =\>"@timestamp" } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 8, 2018, 8:38am UTC](https://discuss.elastic.co/t/there-is-no-dateparsefailure-in-the-tag-but-it-does-not-work/130923/7 "2018-05-08T08:38:45Z")
Um, wait. What's the timezone on the machine where you're running Logstash? UTC+8, by any chance? It looks like the date filter is working fine. Perhaps you need to set the date filter's `timezone` option (or have it parse the GMT string in the timestamp) to override the timezone used when parsing the timestamp. ---
**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\ **Post date:** [May 8, 2018, 9:00am UTC](https://discuss.elastic.co/t/there-is-no-dateparsefailure-in-the-tag-but-it-does-not-work/130923/8 "2018-05-08T09:00:37Z")
the timezone here is GMT+8,I will try to parse the GMT in the time field and try again ---
**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\ **Post date:** [May 9, 2018, 2:41am UTC](https://discuss.elastic.co/t/there-is-no-dateparsefailure-in-the-tag-but-it-does-not-work/130923/9 "2018-05-09T02:41:34Z")
I have tried both using timezone option and put GMT in the "time" field,still the same. ---
**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\ **Post date:** [May 9, 2018, 2:59am UTC](https://discuss.elastic.co/t/there-is-no-dateparsefailure-in-the-tag-but-it-does-not-work/130923/10 "2018-05-09T02:59:58Z")
it does work,i used timezone option,thanks~ ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 6, 2018, 3:00am UTC](https://discuss.elastic.co/t/there-is-no-dateparsefailure-in-the-tag-but-it-does-not-work/130923/11 "2018-06-06T03:00:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.