# Unexpected dateTime parsing exception when importing logs via Logstash **URL:** \ **Category:** Elasticsearch\ **Created:** [November 25, 2014, 11:04am UTC](https://discuss.elastic.co/t/unexpected-datetime-parsing-exception-when-importing-logs-via-logstash/20933 "2014-11-25T11:04:08Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Vagif\_Abilov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vagif_abilov/32/788_2.png) [@Vagif\_Abilov](https://discuss.elastic.co/u/Vagif_Abilov)\ **Post date:** [November 25, 2014, 11:04am UTC](https://discuss.elastic.co/t/unexpected-datetime-parsing-exception-when-importing-logs-via-logstash/20933/1 "2014-11-25T11:04:08Z")
Hello, I am investigating the reason for ES to raise some exceptions while processing data shipped by Logstash, and something doesn't make sense. The software is running on Windows machines, and the log file is a JSON document with dateTime fields formatted using invariant culture. Here's an example of a dateTime value: "ModifiedDate":"2014/11/25 10:22:47.9200 +01:00" In ES log I see that this JSON caused an exception. Elasticsearch complains about parsing ModifiedDate, and it prints the value: "ModifiedDate":"2014.11.25 10:22:49.2100 +01:00" Note that date separators changed! Apparently they now correspond to machine UI culture, but shouldn't ES use the value as is, without reformatting. Also if the date was reformatted it means that ES managed somehow to recognized it as a date, then parse, re-format and only then suddenly complain about it not being a good date, here is the message: IllegalArgumentException: Invalid format: "2014.11.25 10:22:47.9200 +01:00" is malformed at ".11.25 10:22:47.9200 +01:00", so it rejected the date separator. Does anyone know what could be a reason for such behavior? Thanks in advance. Vagif -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/278b0474-097a-41ef-8291-5ea10abb7b75%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/278b0474-097a-41ef-8291-5ea10abb7b75%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Vagif\_Abilov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vagif_abilov/32/788_2.png) [@Vagif\_Abilov](https://discuss.elastic.co/u/Vagif_Abilov)\ **Post date:** [November 25, 2014, 11:45am UTC](https://discuss.elastic.co/t/unexpected-datetime-parsing-exception-when-importing-logs-via-logstash/20933/2 "2014-11-25T11:45:53Z")
Ooops, sorry about that. Spent some more time and found that the offensive message comes from a different server where it was in fact incorrectly formatted. Please disregards the question. Vagif On Tuesday, November 25, 2014 12:04:08 PM UTC+1, Vagif Abilov wrote: > Hello, > > I am investigating the reason for ES to raise some exceptions while > processing data shipped by Logstash, and something doesn't make sense. The > software is running on Windows machines, and the log file is a JSON > document with dateTime fields formatted using invariant culture. Here's an > example of a dateTime value: > > "ModifiedDate":"2014/11/25 10:22:47.9200 +01:00" > > In ES log I see that this JSON caused an exception. Elasticsearch > complains about parsing ModifiedDate, and it prints the value: > > "ModifiedDate":"2014.11.25 10:22:49.2100 +01:00" > > Note that date separators changed! Apparently they now correspond to > machine UI culture, but shouldn't ES use the value as is, without > reformatting. Also if the date was reformatted it means that ES managed > somehow to recognized it as a date, then parse, re-format and only then > suddenly complain about it not being a good date, here is the message: > > IllegalArgumentException: Invalid format: "2014.11.25 10:22:47.9200 > +01:00" is malformed at ".11.25 10:22:47.9200 +01:00", so it rejected the > date separator. > > Does anyone know what could be a reason for such behavior? > > Thanks in advance. > > Vagif -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/56125dc0-d87f-49af-9c9d-0ed3114c9735%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/56125dc0-d87f-49af-9c9d-0ed3114c9735%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:47am UTC](https://discuss.elastic.co/t/unexpected-datetime-parsing-exception-when-importing-logs-via-logstash/20933/3 "2017-07-06T00:47:46Z")