# Unable to parse the date in syslog log message

**URL:** <https://discuss.elastic.co/t/unable-to-parse-the-date-in-syslog-log-message/199835>\
**Category:** Logstash\
**Created:** [September 17, 2019, 2:02pm UTC](https://discuss.elastic.co/t/unable-to-parse-the-date-in-syslog-log-message/199835 "2019-09-17T14:02:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sai\_kiran1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_kiran1/32/44118_2.png) [@sai\_kiran1](https://discuss.elastic.co/u/sai_kiran1)\
**Post date:** [September 17, 2019, 2:02pm UTC](https://discuss.elastic.co/t/unable-to-parse-the-date-in-syslog-log-message/199835/1 "2019-09-17T14:02:02Z")

</div>

I am trying to parse the data in my Syslog log message using different patterns like %SYSLOGTIMESTAMP:syslog\_timestamp} , %{MONTH} +%{MONTHDAY} %{TIME} but am unable to parse the message.

Message I am trying to parse "september 09 09:50:08 "

both the patterns work when I put 'S' in september. But I receive my log as \<13\> september 09 09:50:08.

Can anyone suggest a way to parse this date format without changing the log message that I receive?

Thanks.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 17, 2019, 3:05pm UTC](https://discuss.elastic.co/t/unable-to-parse-the-date-in-syslog-log-message/199835/2 "2019-09-17T15:05:33Z")

</div>

You could upgrade to a more recent version, since this was [fixed](https://github.com/logstash-plugins/logstash-patterns-core/pull/155) in 2016. Or just use a custom pattern that looks like the [current](https://github.com/logstash-plugins/logstash-patterns-core/blob/66905291fc22947b09b64f0bc7800221c2a853e9/patterns/grok-patterns#L51) definition.

---

<div class="post-metadata">

**Author:** ![Mahesh\_Guntumadugu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahesh_guntumadugu/32/54413_2.png) [@Mahesh\_Guntumadugu](https://discuss.elastic.co/u/Mahesh_Guntumadugu)\
**Post date:** [September 19, 2019, 5:28am UTC](https://discuss.elastic.co/t/unable-to-parse-the-date-in-syslog-log-message/199835/3 "2019-09-19T05:28:12Z")

</div>

try the following pattern ![grok%20output](https://us1.discourse-cdn.com/elastic/original/3X/3/2/32dc25a25837659cd9bc29580ab157b9f67c4088.png)

september 09 09:50:08

%{MONTH:month} %{MONTHDAY:day} %{TIME:time}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 17, 2019, 5:29am UTC](https://discuss.elastic.co/t/unable-to-parse-the-date-in-syslog-log-message/199835/4 "2019-10-17T05:29:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.