# Howto modify date format in Parser?

**URL:** <https://discourse.crowdsec.net/t/howto-modify-date-format-in-parser/2145>\
**Category:** crowdsec\
**Created:** [November 19, 2024, 7:45pm UTC](https://discourse.crowdsec.net/t/howto-modify-date-format-in-parser/2145 "2024-11-19T19:45:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fail2ban.bersol.info](https://avatars.discourse-cdn.com/v4/letter/f/a9adbd/32.png) [@fail2ban.bersol.info](https://discourse.crowdsec.net/u/fail2ban.bersol.info)\
**Post date:** [November 19, 2024, 7:45pm UTC](https://discourse.crowdsec.net/t/howto-modify-date-format-in-parser/2145/1 "2024-11-19T19:45:10Z")

</div>

Hi,  
My parsers aren’t parse any log line…

> │ Source │ Lines read │ Lines parsed │ Lines unparsed │ Lines poured to bucket │ Lines whitelisted │  
> ├─────────────────────────────────────────────────┼────────────┼──────────────┼────────────────┼────────────────────────┼───────────────────┤  
> …  
> │ file:/var/log/20241119/sshd.log │ 28 │ - │ 28 │ - │ - │

I suppose because Date format is modified (_centralized log server save logs in another date format_), and I receive this error with explain command:  
_WARN Line 0/1 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode._

Example:  
`20241119-14:40:59 sshd[1872]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=555.5.5.5`

Can I solve without modify all Crowdsecurity Parsers (ssh, nginx…) with the correct Date format?

Any easy solution?

Thank you  
Best Regards,

---

<div class="post-metadata">

**Author:** ![fail2ban.bersol.info](https://avatars.discourse-cdn.com/v4/letter/f/a9adbd/32.png) [@fail2ban.bersol.info](https://discourse.crowdsec.net/u/fail2ban.bersol.info)\
**Post date:** [November 19, 2024, 11:01pm UTC](https://discourse.crowdsec.net/t/howto-modify-date-format-in-parser/2145/2 "2024-11-19T23:01:14Z")

</div>

I forgot mention it.  
I’m using **Docker** container “crowdsecurity/crowdsec”.

---

<div class="post-metadata">

**Author:** ![fail2ban.bersol.info](https://avatars.discourse-cdn.com/v4/letter/f/a9adbd/32.png) [@fail2ban.bersol.info](https://discourse.crowdsec.net/u/fail2ban.bersol.info)\
**Post date:** [November 19, 2024, 11:07pm UTC](https://discourse.crowdsec.net/t/howto-modify-date-format-in-parser/2145/3 "2024-11-19T23:07:18Z")

</div>

Date it’s not the problem.  
Explain command looks parse successfully.

I don’t know why, then. 🤐

---

<div class="post-metadata">

**Author:** ![fail2ban.bersol.info](https://avatars.discourse-cdn.com/v4/letter/f/a9adbd/32.png) [@fail2ban.bersol.info](https://discourse.crowdsec.net/u/fail2ban.bersol.info)\
**Post date:** [November 20, 2024, 7:31am UTC](https://discourse.crowdsec.net/t/howto-modify-date-format-in-parser/2145/4 "2024-11-20T07:31:25Z")

</div>

Sorry,  
problem with acquis.