# Where is \_dateparsefailure?

**URL:** <https://discuss.elastic.co/t/where-is-dateparsefailure/209355>\
**Category:** Logstash\
**Created:** [November 25, 2019, 6:18pm UTC](https://discuss.elastic.co/t/where-is-dateparsefailure/209355 "2019-11-25T18:18:07Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [November 25, 2019, 6:18pm UTC](https://discuss.elastic.co/t/where-is-dateparsefailure/209355/1 "2019-11-25T18:18:07Z")

</div>

I have many column csv files with few thousands lines

getting  
\_dateparsefailure

how do I find out which field is throwing this error?  
I understand that it is one of the date field is doing this. but which one? I have about 15 of them

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [November 27, 2019, 4:06pm UTC](https://discuss.elastic.co/t/where-is-dateparsefailure/209355/2 "2019-11-27T16:06:29Z")

</div>

any idea?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 27, 2019, 4:28pm UTC](https://discuss.elastic.co/t/where-is-dateparsefailure/209355/3 "2019-11-27T16:28:58Z")

</div>

If you have multiple date filters you could have them add tags if they succeed and at the end see which tags are missing.

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [November 27, 2019, 4:52pm UTC](https://discuss.elastic.co/t/where-is-dateparsefailure/209355/4 "2019-11-27T16:52:35Z")

</div>

you mean like this? which will create field called foo\_start\_time

```
date {
         match => ["start_time", "dd-MMM-yy HH:mm"]
         target => "start_time"
      }
     add_tag => ["foo_%{start_time}"]
   }
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 27, 2019, 4:59pm UTC](https://discuss.elastic.co/t/where-is-dateparsefailure/209355/5 "2019-11-27T16:59:55Z")

</div>

No, I am thinking of something more like

```
date { match => ["column1", "..."] target => "..." add_tag=> ["column1-OK"] }
date { match => ["column2", "..."] target => "..." add_tag=> ["column2-OK"] }
date { match => ["column3", "..."] target => "..." add_tag=> ["column3-OK"] }

```

Then use a ruby filter that iterates over the set of tags you expect and get a list of what is missing. Something like this (which I have not tested)...

```
notOK = []
tags = event.get("tags")
["column1-OK", "column2-OK", "column3-OK"] .each { |x|
    unless tags.include?(x)
        notOK << x
    end
}
event.set("columnsNotOK", notOK)
```

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [November 27, 2019, 5:04pm UTC](https://discuss.elastic.co/t/where-is-dateparsefailure/209355/6 "2019-11-27T17:04:11Z")

</div>

perefect even when I get this column1-ok, column2-ok I will know which one is failing and correct it.  
I will test this out on standard out to get fixed.

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [November 27, 2019, 5:25pm UTC](https://discuss.elastic.co/t/where-is-dateparsefailure/209355/7 "2019-11-27T17:25:58Z")

</div>

Thank you @Badger again.

I added this to creation\_date and got tag display back.

then added to  
added to start\_date but didn't got start\_date-OK, hence fix that and started getting this

```
     [0] "creation_date-OK",
    [1] "start_date-OK",
    [2] "_dateparsefailure"

```

Move on to few more until I stop getting \_dateparsefailure.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 25, 2019, 5:26pm UTC](https://discuss.elastic.co/t/where-is-dateparsefailure/209355/8 "2019-12-25T17:26:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.