Error on parse date timestamp in apache_log

Description

Hi, I started to learn to use logstash to read the article “10-minute-walkthrough” (http://logstash.net/docs/1.1.5/tutorials/10-minute-walkthrough/)
On the step 5 (real world example. Let's backfill some old apache logs. First, let's use grok. ) i have a problem:

Exception in thread "filter|worker|0" java.lang.IllegalArgumentException: Invalid format: "18/Aug/2011:06:00:14 -0700" is malformed at "Aug/2011:06:00:14 -0700"
at org.joda.time.format.DateTimeFormatter.parseDateTime(DateTimeFormatter.java:866)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:616)
........

all configs and apache logs i get from manual “10-minute-walkthrough”

logstash.conf
input {
tcp {
type => "apache"
port => 3333
}
}

filter {
grok {
type => "apache"
pattern => "%{COMBINEDAPACHELOG}"
}

date {
type => "apache"
timestamp => "dd/MMM/yyyy:HH:mm:ss Z"
}
}

output {

stdout {
debug => true
}
}

apache_log.1
129.92.249.70 - - [18/Aug/2011:06:00:14 -0700] "GET /style2.css HTTP/1.1" 200 1820 "http://www.semicomplete.com/blog/geekery/bypassing-captive-portals.html" "Mozilla/5.0 (iPad; U; CPU OS 4_3_5 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8L1 Safari/6533.18.5"

ogstash version is 1.1.5
my system locale is LANG=ru_RU.UTF-8
OS - Ubuntu server 12.04
Java version "1.6.0_24"
OpenJDK Runtime Environment (IcedTea6 1.11.5) (6b24-1.11.5-0ubuntu1~12.04.1)
OpenJDK Server VM (build 20.0-b12, mixed mode)

Activity

Show:
Jordan Sissel
December 3, 2012, 4:27 AM

What's your locale set to? The Date parser is language-aware and wont' likely know that "Aug" is "August" if your locale isnt' set to an english one.

Philippe Weber
December 3, 2012, 6:34 AM

As your system locale is russian, the date filter internal (jodatime) use this locale for month name parsing.
You should update your configuration to use english locale in the date filter "en" or "en_US"

Vadim Petrov
December 4, 2012, 6:17 AM

After adding locale => "en" parameter, it working.
My apache logs parsing too.
Thanks!

Vadim Petrov
December 4, 2012, 6:19 AM

Not a bug

MarcM
March 3, 2014, 5:13 PM

Thank you for this comment Vadim

Assignee

Logstash Developers

Reporter

Vadim Petrov

Labels

Affects versions

Configure