# 5.1.1 custom format isn't supported **URL:** \ **Category:** Kibana\ **Created:** [December 28, 2016, 9:54am UTC](https://discuss.elastic.co/t/5-1-1-custom-format-isnt-supported/70125 "2016-12-28T09:54:58Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![alexis-storever](https://avatars.discourse-cdn.com/v4/letter/a/df788c/32.png) [@alexis-storever](https://discuss.elastic.co/u/alexis-storever)\ **Post date:** [December 28, 2016, 9:54am UTC](https://discuss.elastic.co/t/5-1-1-custom-format-isnt-supported/70125/1 "2016-12-28T09:54:59Z")
Hi, I subscribe to a 14days trial to move from my test env (5.1.1) to your could base solution. I load the elasticsearch thru Logstash with my IIS server logs. When I look into the discover, I get this message: ``` > Discover: [unsupported_operation_exception] custom format isn't supported ``` > ``` > Error: [unsupported_operation_exception] custom format isn't supported > at respond (https://079a55c5c95666ada3fba5517ae47066.eu-west-1.aws.found.io/bundles/kibana.bundle.js?v=14566:14:2082) > at checkRespForFailure (https://079a55c5c95666ada3fba5517ae47066.eu-west-1.aws.found.io/bundles/kibana.bundle.js?v=14566:14:1310) > at https://079a55c5c95666ada3fba5517ae47066.eu-west-1.aws.found.io/bundles/kibana.bundle.js?v=14566:1:23441 > at processQueue (https://079a55c5c95666ada3fba5517ae47066.eu-west-1.aws.found.io/bundles/commons.bundle.js?v=14566:38:23621) > at https://079a55c5c95666ada3fba5517ae47066.eu-west-1.aws.found.io/bundles/commons.bundle.js?v=14566:38:23888 > at Scope.$eval (https://079a55c5c95666ada3fba5517ae47066.eu-west-1.aws.found.io/bundles/commons.bundle.js?v=14566:39:4619) > at Scope.$digest (https://079a55c5c95666ada3fba5517ae47066.eu-west-1.aws.found.io/bundles/commons.bundle.js?v=14566:39:2359) > at Scope.$apply (https://079a55c5c95666ada3fba5517ae47066.eu-west-1.aws.found.io/bundles/commons.bundle.js?v=14566:39:5037) > at done (https://079a55c5c95666ada3fba5517ae47066.eu-west-1.aws.found.io/bundles/commons.bundle.js?v=14566:37:25027) > at completeRequest (https://079a55c5c95666ada3fba5517ae47066.eu-west-1.aws.found.io/bundles/commons.bundle.js?v=14566:37:28702) > > ``` The logstash conf is: > input { > beats { > port =\> 5044 > type =\> "log" > } > } > filter { > > #ignore log comments > if [message] =~ "^#" { > drop {} > } > > grok { > match =\> ["message", "%{TIMESTAMP\_ISO8601:timestamp} %{IP:sourceip} %{WORD:method} %{URIPATH:uristem} (?:-|%{NOTSPACE:uriquery}) %{POSINT:port} (?:-|%{NOTSPACE:username}) %{IP:clientip} %{NOTSPACE:useragent} %{NUMBER:status} %{NUMBER:substatus} %{NUMBER:win32status} %{NUMBER:timetaken}"] > } > > #Set the Event Timesteamp from the log > date { > match =\> ["log\_timestamp", "YYYY-MM-dd HH:mm:ss"] > timezone =\> "Etc/UTC" > } > > useragent { > source=\> "useragent" > prefix=\> "browser" > } > > mutate { > remove\_field =\> ["log\_timestamp"] > } > } > output { > elasticsearch { > hosts =\> "xxxx:9200" > user =\> "xxxx" > password =\> "xxxx" > manage\_template =\> false > index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}" > document\_type =\> "%{[@metadata][type]}" > } > } Everything work on my own server why not on the cloud service. Could you help ? Tia -Alexis ---
**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\ **Post date:** [December 28, 2016, 5:26pm UTC](https://discuss.elastic.co/t/5-1-1-custom-format-isnt-supported/70125/2 "2016-12-28T17:26:11Z")
Looks like that error is coming from Elasticsearch, but it's possible it's caused by something that Kibana is try to do. Seems like it's been happening for a while as well, all the way back to 4.4/2.2: [Custom format isn't supported](https://discuss.elastic.co/t/custom-format-isnt-supported/41083) I'm not sure why it would work locally for you but not in Cloud. Can you share any customizations you have in your `config/elasticsearch.yml` and `config/kibana.yml` files in your local installation? ---
**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\ **Post date:** [December 28, 2016, 5:29pm UTC](https://discuss.elastic.co/t/5-1-1-custom-format-isnt-supported/70125/3 "2016-12-28T17:29:49Z")
It's also possible that this is caused by a mapping issue. Perhaps one of the fields you've told Kibana is a date isn't mapped as a date in Elasticsearch. If ES thinks it's, say, a number, then that could explain the "custom format" error message. Can you share your field mappings from Elasticsearch? ---
**Author:** ![alexis-storever](https://avatars.discourse-cdn.com/v4/letter/a/df788c/32.png) [@alexis-storever](https://discuss.elastic.co/u/alexis-storever)\ **Post date:** [December 29, 2016, 8:00am UTC](https://discuss.elastic.co/t/5-1-1-custom-format-isnt-supported/70125/4 "2016-12-29T08:00:36Z")
Hi Joe, thank you for the answer. I've added a new index pattern for the IIS logs instead of the wildcard to get all data. This workaround the issue. (the wildcard work fine the my dev). I still running with the default configuration file for both. The only difference could be that my dev platform is running on windows ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 26, 2017, 8:01am UTC](https://discuss.elastic.co/t/5-1-1-custom-format-isnt-supported/70125/5 "2017-01-26T08:01:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.