# CrowdSec custom parser not recognizing timestamp

**URL:** <https://discourse.crowdsec.net/t/crowdsec-custom-parser-not-recognizing-timestamp/2765>\
**Category:** crowdsec\
**Created:** [February 11, 2026, 12:29pm UTC](https://discourse.crowdsec.net/t/crowdsec-custom-parser-not-recognizing-timestamp/2765 "2026-02-11T12:29:55Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lukes](https://avatars.discourse-cdn.com/v4/letter/l/4da419/32.png) [@Lukes](https://discourse.crowdsec.net/u/Lukes)\
**Post date:** [February 11, 2026, 12:29pm UTC](https://discourse.crowdsec.net/t/crowdsec-custom-parser-not-recognizing-timestamp/2765/1 "2026-02-11T12:29:55Z")

</div>

Hi all,

I’m new to CrowdSec and I’m trying to create a custom parser for Stalwart logs.

My logs look like this:

```auto
2026-02-11T08:16:01Z INFO Banned due to scan (security.scan-ban) listenerId = "smtp", localPort = 25, remoteIp = 164.90.161.69, remotePort = 19983, remoteIp = 164.90.161.69, reason = "Invalid SMTP command"

```

Current parser attempt (stalwart-logs.yaml)

```auto
name: local/stalwart-logs
description: "Parse Stalwart logs for remoteIp"
filter: "evt.Line.Raw contains \"remoteIp =\""

grok:
  apply_on: evt.Line.Raw
  pattern: 'remoteIp = %{IP:remote_addr}'

statics:
  - meta: source_ip
    expression: "evt.Parsed.remote_addr"

```

When I run:

```auto
sudo cscli explain --type stalwart --log '<log line>'

```

I get the warning:

```auto
WARNING Line 0/1 is missing evt.StrTime

```

This means that CrowdSec did not parse the timestamp, so in time-machine/forensic mode the line cannot be processed correctly.

I think the issue is that my Grok pattern does not include the timestamp, but I’m not sure how to include it properly in the parser.

Could someone provide an example of how to capture the ISO8601 timestamp in CrowdSec parsers so evt.StrTime is correctly populated?

Thanks for help.