# Unable to parse timestamp

**URL:** <https://discuss.elastic.co/t/unable-to-parse-timestamp/147067>\
**Category:** Logstash\
**Created:** [September 3, 2018, 12:02pm UTC](https://discuss.elastic.co/t/unable-to-parse-timestamp/147067 "2018-09-03T12:02:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nithani25](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nithani25/32/33457_2.png) [@Nithani25](https://discuss.elastic.co/u/Nithani25)\
**Post date:** [September 3, 2018, 12:02pm UTC](https://discuss.elastic.co/t/unable-to-parse-timestamp/147067/1 "2018-09-03T12:02:16Z")

</div>

HI Team,  
I am working on some logs which looks something like below

* * *

## 2018-09-02 23:02:18,358|[[ACTIVE] ExecuteThread: '15' for queue: 'weblogic.kernel.Default (self-tuning)']|ERROR|GlobalExceptionMapper|Unknown|Unknown|Unknown|Unknown|Unknown|HTTP 405 Method Not Allowed javax.ws.rs.NotAllowedException: HTTP 405 Method Not Allowed

and my logstash conf file as below

* * *

```
filter {
    grok {
      match => { "message" => "%{TIMESTAMP_ISO8601:weblogtime}\|%{DATA:ThreadDetails}\|%{LOGLEVEL:webtrace}\|%{DATA:loggerclass}\|%{URIPATHPARAM:ServiceURL}\|%{DATA:UserId}\|%{DATA:SessionId}\|%{DATA:TransactionsId}\|%{DATA:ErrorCode}\|%{GREEDYDATA:defaultlogmessage}" }
        }
      date {
        match => ["weblogtime" , "ISO8601"]
        target => @timestamp
          }
      mutate {
        remove_field => ["message"]
          }
}

```

* * *

I am getting constant dateparsefailure for the above conf,i have find the right match and overwrite with @timestamp.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 3, 2018, 12:10pm UTC](https://discuss.elastic.co/t/unable-to-parse-timestamp/147067/2 "2018-09-03T12:10:15Z")

</div>

Your configuration looks correct. If the date filter fails to parse a string and tags it with `_dateparsefailure` there should be something about it in the Logstash log.

---

<div class="post-metadata">

**Author:** ![Nithani25](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nithani25/32/33457_2.png) [@Nithani25](https://discuss.elastic.co/u/Nithani25)\
**Post date:** [September 3, 2018, 12:31pm UTC](https://discuss.elastic.co/t/unable-to-parse-timestamp/147067/3 "2018-09-03T12:31:38Z")

</div>

Yes, I strongly believe that configuration is close enough but there are two big problems which i wanted to highlight here..

I am getting some grokparsefailures which is very strange and i have very high parse success rate, so am dropping the failed ones here..

I am not getting the below picture while creating index in kibana..

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/8/58b3fe161f74a9713032415415c6d7853b1296eb.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 1, 2018, 12:38pm UTC](https://discuss.elastic.co/t/unable-to-parse-timestamp/147067/4 "2018-10-01T12:38:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.