# Weird? dateparse fail , if corrected, messages vanish

**URL:** <https://discuss.elastic.co/t/weird-dateparse-fail-if-corrected-messages-vanish/88026>\
**Category:** Logstash\
**Created:** [June 2, 2017, 7:57am UTC](https://discuss.elastic.co/t/weird-dateparse-fail-if-corrected-messages-vanish/88026 "2017-06-02T07:57:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![uschellh](https://avatars.discourse-cdn.com/v4/letter/u/65b543/32.png) [@uschellh](https://discuss.elastic.co/u/uschellh)\
**Post date:** [June 2, 2017, 7:57am UTC](https://discuss.elastic.co/t/weird-dateparse-fail-if-corrected-messages-vanish/88026/1 "2017-06-02T07:57:50Z")

</div>

Hello,

turns out that as long there is a dateparse fail, kibana will show the logfile entry based on @timestamp.  
if there is no dateparse fail, kibana will show based on timestamp.

timestamp was filled all the time.

"messages are gone" and "vanished likely mean they are to be found at another time, because of not delivered timezone by switches

Hello folks, i am biting my teeth out with this.

as long as i have a non-matching date declaration, messages are found in kibana and get tagged with dateparsefailure . When i correct the date declarations, those messages are gone.

Any hints for that ?

Config with Dateparse fail:

filter {  
if [type] == "cisco" {  
grok {  
patterns\_dir =\> "/etc/logstash/patterns/"  
match =\> ["message", "%{CISCO\_IOS\_HEADER} %{GREEDYDATA:cisco\_message}"]  
}  
date {  
match =\> ["timestamp",  
"MMM dd HH:mm:ss",  
"MMM d HH:mm:ss"  
]  
}  
syslog\_pri { }  
grok {  
patterns\_dir =\> "/etc/logstash/patterns/"  
match =\> [  
"cisco\_message", "%{CISCO\_IOS\_LINPROTO\_UPDOWN}",  
"cisco\_message", "%{CISCO\_IOS\_ILPOWER}",  
"cisco\_message", "%{CISCO\_IOS\_IPACCESSLOGP}"  
]  
tag\_on\_failure =\> ["\_no\_ciscomatch"]  
}  
}  
}

* * *

CISCO\_IOS\_HEADER \<%{NUMBER:message\_type\_id}\>%{NUMBER:internal\_id}: %{GREEDYDATA}"%{HOSTNAME:hostname}:5005"]☹ %{INT:seq2\_no}:)? %{CISCOTIMESTAMP:timestamp}: %?%{CISCO\_IOS\_TAG:ios\_tag}:  
CISCO\_IOS\_TAG %{WORD:ios\_facility}-(%{WORD:ios\_switchnumber}-)?%{INT:ios\_severity}-%{WORD:ios\_mnemonic}  
CISCOTIMESTAMP %{MONTH} +%{MONTHDAY}(?: %{YEAR})? %{TIME}  
CISCOTIMESTAMPTZ %{MONTH} +%{MONTHDAY}(?: %{YEAR})? %{TIME} %{TZ}

CISCO\_IOS\_LINPROTO\_UPDOWN (Line protocol on Interface %{DATA:interface}, changed state to %{WORD:state})  
CISCO\_IOS\_ILPOWER (Interface %{DATA:interface}: %{DATA:description}( (%{DATA:switch}))?)  
CISCO\_IOS\_IPACCESSLOGP (fman\_fp\_image: list %{DATA:acl} permitted %{WORD:protocol} %{IP:src\_ip}(%{INT:src\_port}) -\> %{IP:dst\_ip}(%{INT:dst\_port}), %{INT:count} packet)

AT (%{TIME} %{WORD} %{DAY} %{MONTH} %{MONTHDAY} %{YEAR})  
UNKNOWN (unknown|Unknown|UNKNOWN)  
UPDATE\_TIMESTAMP (%{TIME} %{WORD} %{DAY} %{MONTH} %{MONTHDAY} %{YEAR})

Message there with dateparse fail:

\<189\>962319: swi-rha-edv4-nord: [syslog@9 s\_id ="swi-rha-edv4-nord:5005"]: 962314: Jun 2 06:45:49.815: %ILPOWER-5-IEEE\_DISCONNECT: Interface Gi1/0/9: PD removed

Message without dateparse fail:

\<190\>5956344: [syslog@9 s\_id ="ASR1:5005"]: Jun 2 09:52:35: %FMANFP-6-IPACCESSLOGP: F0: fman\_fp\_image: list ACL\_SIT\_IN permitted tcp 95.39.53.51(57648) -\> 112.211.122.121(25), 1 packet

now, i "correct" the dateparsing declaration:

date {  
match =\> ["timestamp",  
"MMM dd HH:mm:ss.SSS",  
"MMM d HH:mm:ss.SSS",  
"MMM dd HH:mm:ss",  
"MMM d HH:mm:ss"  
]  
}

no new messages from swi-rha-edv4-nord, no error log from logstash.

what i have seen, index declaration as viewed from kibana shows timestamp as string, not date

i am lost after hours of trying, hope someone got some pointers

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 30, 2017, 11:38am UTC](https://discuss.elastic.co/t/weird-dateparse-fail-if-corrected-messages-vanish/88026/4 "2017-06-30T11:38:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.