Date filter doesn't match month names i.e 'Sep'


Problem is probbably caused by Joda Time library.
Description of an isssue:

1. I do have field with value : "2004 30 Sep"
2. I'm trying to parse it with date filter
date {
match => [ "DATETIME", "yyyy dd MMM" ]

So MMM should catch the word "Sep" but instead it gives off

Failed parsing date from field {:field=>"DATETIME", :value=>"2004 30 Sep", :exception=>java.lang.IllegalArgumentException: Invalid format: "2004 30 Sep" is malformed at "Sep", :level=>:warn}

I've posted this problem to stackoverflow:


Matteo Dessalvi
December 6, 2013, 11:00 AM

I have tried to filter your date timestamp on the fly with Logstash, like this:

Once Logstash is started you can just enter your data and then press enter. In my case I did enter:

2004 30 Sep

and then I got this answer:

2004-09-29T22:00:00.000+0000 my_log_host 2004 30 Sep

Your problem does not seem to be reproducible. Have you tried to check if the locale in your settings
are matched by your date filter? Using this option:
you can do that.

Mateusz Kaczanowski
December 6, 2013, 1:02 PM

"locale" => "en" solved the problem.


Matteo Dessalvi
December 6, 2013, 1:35 PM

You are welcome. Well, I believe you could close this bug report then.


Logstash Developers


Mateusz Kaczanowski

Affects versions