# Trouble parsing date with date filter

**URL:** <https://discuss.elastic.co/t/trouble-parsing-date-with-date-filter/79646>\
**Category:** Logstash\
**Created:** [March 22, 2017, 8:21pm UTC](https://discuss.elastic.co/t/trouble-parsing-date-with-date-filter/79646 "2017-03-22T20:21:25Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jclose](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@jclose](https://discuss.elastic.co/u/jclose)\
**Post date:** [March 22, 2017, 8:21pm UTC](https://discuss.elastic.co/t/trouble-parsing-date-with-date-filter/79646/1 "2017-03-22T20:21:25Z")

</div>

I'm having trouble with some date parsing. The entry I'm getting doesn't have a year in the datestamp, so I'm trying to pull the year out of @timestamp, and then put the proper timestamp back into @timestamp.

So my date format looks like:  
Mar 22 15:09:49

What I have done is this:

> filter {  
> dissect {  
> mapping =\> ["@timestamp", "%{year}-%{?MON}-%{?DAY}T%{?HOUR}:%{?SEC}:%{?MIN}%{?REMAINDER}"]  
> }  
> grok {  
> match =\> ["message", "%{MONTH:month} %{MONTHDAY:day} %{NOTSPACE:time} %{GREEYDATA:msg}"]  
> }  
> mutate {  
> add\_field =\> {  
> "gen\_datetime" =\> "%{year}-%{month}-%{day} %{time}"  
> }  
> remove\_field =\> ["year", "month", "day", "time"]  
> }  
> date {  
> match =\> ["gen\_datetime", "yyyy-MMM-dd HH:mm:ss"]  
> target =\> "@timestamp"  
> }  
> }

The idea is to put the log values into gen\_datetime, and then use that to move back into @timestamp.

The error I am getting is: "reason"=\>"failed to parse [gen\_datetime]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Invalid format: "2017-Mar-22 15:09:49" is malformed at "-Mar-22 15:09:49""}

To me, it looks right. Any clue on what I'm doing wrong?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 23, 2017, 6:07am UTC](https://discuss.elastic.co/t/trouble-parsing-date-with-date-filter/79646/2 "2017-03-23T06:07:55Z")

</div>

It looks like Elasticsearch has mapped `gen_datetime` as a timestamp field but isn't able to parse "2017-Mar-22 15:09:49" as a timestamp. Since you probably don't want to keep that field anyway I suggest you add `remove_field => ["gen_datetime"]` to your date filter so that the field is deleted after a successful parsing operation.

---

<div class="post-metadata">

**Author:** ![jclose](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@jclose](https://discuss.elastic.co/u/jclose)\
**Post date:** [March 23, 2017, 12:30pm UTC](https://discuss.elastic.co/t/trouble-parsing-date-with-date-filter/79646/3 "2017-03-23T12:30:39Z")

</div>

I'm creating the "gen\_datetime" field with the following

> mutate {  
> add\_field =\> { "gen\_datetime" =\> "%{year}-%{month}-%{day} %{time}"  
> }

I'm creating that field, and filling it with the values from other fields.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 23, 2017, 12:44pm UTC](https://discuss.elastic.co/t/trouble-parsing-date-with-date-filter/79646/4 "2017-03-23T12:44:31Z")

</div>

Yes, that was clear from your previous post.

---

<div class="post-metadata">

**Author:** ![jclose](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@jclose](https://discuss.elastic.co/u/jclose)\
**Post date:** [March 23, 2017, 2:51pm UTC](https://discuss.elastic.co/t/trouble-parsing-date-with-date-filter/79646/5 "2017-03-23T14:51:33Z")

</div>

So after playing with this for a long while, I figured out the issue.

I don't quite know why the following works, but it does...

To create the gen\_datetime, I used:

> add\_field =\> { "gen\_datetime" =\> "%{year}-%{month}-%{day} %{time} America/Chicago" }

And then for the date creation, I used:

> match =\> ["gen\_datetime", "yyyy-MMM-dd HH:mm:ss ZZZ"]  
> target =\> "@timestamp"

This works.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2017, 2:51pm UTC](https://discuss.elastic.co/t/trouble-parsing-date-with-date-filter/79646/6 "2017-04-20T14:51:46Z")

</div>

Closed on April 20, 2017, 2:51pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.