Error on parse date timestamp in apache_log


Hi, I started to learn to use logstash to read the article “10-minute-walkthrough” (
On the step 5 (real world example. Let's backfill some old apache logs. First, let's use grok. ) i have a problem:

Exception in thread "filter|worker|0" java.lang.IllegalArgumentException: Invalid format: "18/Aug/2011:06:00:14 -0700" is malformed at "Aug/2011:06:00:14 -0700"
at org.joda.time.format.DateTimeFormatter.parseDateTime(
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(
at sun.reflect.DelegatingMethodAccessorImpl.invoke(
at java.lang.reflect.Method.invoke(

all configs and apache logs i get from manual “10-minute-walkthrough”

input {
tcp {
type => "apache"
port => 3333

filter {
grok {
type => "apache"

date {
type => "apache"
timestamp => "dd/MMM/yyyy:HH:mm:ss Z"

output {

stdout {
debug => true

apache_log.1 - - [18/Aug/2011:06:00:14 -0700] "GET /style2.css HTTP/1.1" 200 1820 "" "Mozilla/5.0 (iPad; U; CPU OS 4_3_5 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8L1 Safari/6533.18.5"

ogstash version is 1.1.5
my system locale is LANG=ru_RU.UTF-8
OS - Ubuntu server 12.04
Java version "1.6.0_24"
OpenJDK Runtime Environment (IcedTea6 1.11.5) (6b24-1.11.5-0ubuntu1~12.04.1)
OpenJDK Server VM (build 20.0-b12, mixed mode)


Jordan Sissel
December 3, 2012, 4:27 AM

What's your locale set to? The Date parser is language-aware and wont' likely know that "Aug" is "August" if your locale isnt' set to an english one.

Philippe Weber
December 3, 2012, 6:34 AM

As your system locale is russian, the date filter internal (jodatime) use this locale for month name parsing.
You should update your configuration to use english locale in the date filter "en" or "en_US"

Vadim Petrov
December 4, 2012, 6:17 AM

After adding locale => "en" parameter, it working.
My apache logs parsing too.

Vadim Petrov
December 4, 2012, 6:19 AM

Not a bug

March 3, 2014, 5:13 PM

Thank you for this comment Vadim


Logstash Developers


Vadim Petrov


Affects versions