# For rule 'parse event timestamp': In call to function 'parse\_date' at 5:19 an exception was thrown: Invalid format: "" **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** pipeline-rules\ **Created:** [December 30, 2018, 7:09am UTC](https://community.graylog.org/t/for-rule-parse-event-timestamp-in-call-to-function-parse-date-at-5-19-an-exception-was-thrown-invalid-format/8213 "2018-12-30T07:09:25Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![pradeep57498755](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/pradeep57498755/32/3529_2.png) [@pradeep57498755](https://community.graylog.org/u/pradeep57498755)\ **Post date:** [December 30, 2018, 7:09am UTC](https://community.graylog.org/t/for-rule-parse-event-timestamp-in-call-to-function-parse-date-at-5-19-an-exception-was-thrown-invalid-format/8213/1 "2018-12-30T07:09:25Z")
I want to pipeline my log timestamp with graylog but i got Invalid format error **grok my timestamp into Timestamp\_tweet** **sample:- Fri Dec 21 19:09:36 +0000 2018** rule “parse event timestamp” when true then let new\_date = parse\_date(to\_string($message.Timestamp\_tweet), “EEE MMM dd HH:mm:ss Z yyyy”); set\_field(“timestamp”, new\_date); end how can i solve this issue ? ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [January 6, 2019, 12:03pm UTC](https://community.graylog.org/t/for-rule-parse-event-timestamp-in-call-to-function-parse-date-at-5-19-an-exception-was-thrown-invalid-format/8213/2 "2019-01-06T12:03:04Z")
First you would get faster help if you format your postings in a way that somebody that is not you can unterstand what you write easily. Your Sample timestamp is: `Fri Dec 21 19:09:36 +0000 2018` and you try to match that with the following settings: `EEE MMM dd HH:mm:ss Z yyyy`. For me I got this parsing with the following working: `E MMM dd HH:mm:ss Z Y`. But I **guess** (because of your bad formatting) that the date is not the only content of your sample timestamp and you need to parse place that into a single field before you use the `parse_date` function. ---
**Author:** ![pradeep57498755](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/pradeep57498755/32/3529_2.png) [@pradeep57498755](https://community.graylog.org/u/pradeep57498755)\ **Post date:** [January 9, 2019, 4:46am UTC](https://community.graylog.org/t/for-rule-parse-event-timestamp-in-call-to-function-parse-date-at-5-19-an-exception-was-thrown-invalid-format/8213/3 "2019-01-09T04:46:50Z")
> [@jan](#): > > content I am changed my pipeline format as E MMM dd HH:mm:ss Z Y but no luck rule “parse event timestamp” when true then let new\_date = parse\_date(to\_string($message.Timestamp\_tweet), “E MMM dd HH:mm:ss Z Y);”); set\_field(“timestamp”, new\_date); end **log sample** “Mon Jan 07 17:30:00 +0000 2019 @Very excited that Apple is bringing AirPlay and iTunes to my Vizio TV (and apparently Samsung TVs too). An important [https://twitter.com/i/web/status/1082328512420171776](https://t.co/4kbvJRfGwb)” i have only grokked the timestamp(Mon Jan 07 17:30:00 +0000 2019) into **Timestamp\_tweet** ![grok_sample](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/1/18c4e79b7c51428f3b2e5044926756e182b183b3.png) Is anything wrong with my grok? ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [January 9, 2019, 7:17am UTC](https://community.graylog.org/t/for-rule-parse-event-timestamp-in-call-to-function-parse-date-at-5-19-an-exception-was-thrown-invalid-format/8213/4 "2019-01-09T07:17:46Z")
the question is - does the grok date extractor run as extractor or processing pipeline? Does it run before or after your rule? because the rule above can only work if the field “Timestamp\_tweet” is given in the message. ---
**Author:** ![pradeep57498755](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/pradeep57498755/32/3529_2.png) [@pradeep57498755](https://community.graylog.org/u/pradeep57498755)\ **Post date:** [January 9, 2019, 8:52am UTC](https://community.graylog.org/t/for-rule-parse-event-timestamp-in-call-to-function-parse-date-at-5-19-an-exception-was-thrown-invalid-format/8213/5 "2019-01-09T08:52:23Z")
run as processing pipeline Does it run before or after your rule? I didn’t get that ? 1)created grok for timestamp 2)add new pipeline 3)created rule for pipeline i am done this steps and i got Invalid format error ![timestamp_issue](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/c/c1a8b305e8a504911ce8d97b1627a3b3f83606fd.png) ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [January 9, 2019, 2:34pm UTC](https://community.graylog.org/t/for-rule-parse-event-timestamp-in-call-to-function-parse-date-at-5-19-an-exception-was-thrown-invalid-format/8213/6 "2019-01-09T14:34:56Z")
can you please be a little more specific about `created grok for timestamp` - what does that mean exactly for you? where did you created that and how should that run on incoming messages? ---
**Author:** ![pradeep57498755](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/pradeep57498755/32/3529_2.png) [@pradeep57498755](https://community.graylog.org/u/pradeep57498755)\ **Post date:** [January 9, 2019, 4:28pm UTC](https://community.graylog.org/t/for-rule-parse-event-timestamp-in-call-to-function-parse-date-at-5-19-an-exception-was-thrown-invalid-format/8213/7 "2019-01-09T16:28:28Z")
“Mon Jan 07 17:30:00 +0000 2019 @Very excited that Apple is bringing AirPlay and iTunes to my Vizio TV (and apparently Samsung TVs too). An important [https://t.co/4kbvJRfGwb”](https://t.co/4kbvJRfGwb%E2%80%9D) - I want to change graylog timestamp to this log timestamp - i am using input as gelf tcp in graylog and log comes from fluentd - created grok for timestamp:- through system --\> grok, I stored log timesamp value (Mon Jan 07 17:30:00 +0000 2019) in Timestamp\_tweet - Then i created new pipeline and rule - i am following this url to fix my issue:- [Searching imported logs by log timestamp, not time Graylog received the log](https://community.graylog.org/t/searching-imported-logs-by-log-timestamp-not-time-graylog-received-the-log/233) - rule:- rule “parse event timestamp” when true then let new\_date = parse\_date(to\_string($message.Timestamp\_tweet), “E MMM dd HH:mm:ss Z Y);”); set\_field(“timestamp”, new\_date); end - i dont know how its comes with incoming messages ,after creating pipeline and its rule, i got a field called gl2\_processing\_error ![error_grok](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/c/cf5284b56737d1617bf77c631ade5112ebd6b511.png) ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [January 10, 2019, 7:01am UTC](https://community.graylog.org/t/for-rule-parse-event-timestamp-in-call-to-function-parse-date-at-5-19-an-exception-was-thrown-invalid-format/8213/8 "2019-01-10T07:01:16Z")
so you actually do not use any processing pipeline or extractor to make the field “Timestamp\_tweet” available? The `parse_date` function will need the date to be the only value in the field as it will not try to match something that looks like the given date. ---
**Author:** ![pradeep57498755](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/pradeep57498755/32/3529_2.png) [@pradeep57498755](https://community.graylog.org/u/pradeep57498755)\ **Post date:** [January 10, 2019, 10:11am UTC](https://community.graylog.org/t/for-rule-parse-event-timestamp-in-call-to-function-parse-date-at-5-19-an-exception-was-thrown-invalid-format/8213/9 "2019-01-10T10:11:22Z")
NO,how can i do it with processing pipeline? i am only grok the timestamp and stored in Timestamp\_tweet and i created pipeline rule with this Timestamp\_tweet “rule “parse event timestamp” when true then let new\_date = parse\_date(to\_string($message.Timestamp\_tweet), “E MMM dd HH:mm:ss Z Y);”); set\_field(“timestamp”, new\_date); end” ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [January 24, 2019, 10:11am UTC](https://community.graylog.org/t/for-rule-parse-event-timestamp-in-call-to-function-parse-date-at-5-19-an-exception-was-thrown-invalid-format/8213/10 "2019-01-24T10:11:26Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.