logging - Parsing timestamp using date format in logstash -

i'm working on parsing timestamp couchdb log. entire timestamp getting processed correctly when seen in stdout, _grokparsefailure observed when viewing kibana on top of elasticsearch.

ex logline :

[thu, 31 jul 2014 17:14:28 gmt] [info] [<0.23047.647>] 10.30.50.48 - - head /z_775-797_api_docs 200 

i've followed these links in parsing date format : http://logstash.net/docs/1.4.2/filters/date , http://joda-time.sourceforge.net/apidocs/org/joda/time/format/datetimeformat.html

my parse code :

grok{       match => { "message" => "%{syslog5424sd:log_time} \[info] %{syslog5424sd:response_time} %{ipv4:ip_address} - - %{word:http_method} %{uripath} %{int:file_value}" } }  date{ match => ["log_time","[eee, dd mmm yyyy hh:mm:ss zzz]"] } 

my output code :

output {   elasticsearch { host => localhost }   stdout { codec => json } } 

where log_time = [thu, 31 jul 2014 17:14:28 gmt] , output timestamp "@timestamp":"2014-07-31t17:14:28.000z"

the data displayed under stdout "@timestamp":"2014-07-31t17:14:28.000z" without grok parse error in kibana time of parsing coming timestamp , _grokparseerror tag present. couldn't understand why there difference between standard out , kibana. tried deleting elasticsearch indexes , .sincedb files still errors remain.

please if have ideas

kibana viewer! grok parse failure not related kibana. problem have meet of logs not in format , cause parsing failure. then, timestamp value log event current time.

please check logs whether of them in format! or, can try use kibana date picker pick logs time want view, say: 2014-07-31. otherwise default datepicker in kibana pick last 24 hours logs.

updated: in comment have ask "how detect failures in logstash"

when grok filter parses failure, logstash add tag value _grokparsefailure. then, can use if condition failure handling.

if "_grokparsefailure" in [tags] {   # failure handle }