# Add date{} config make logstash not working

**URL:** https://discuss.elastic.co/t/add-date-config-make-logstash-not-working/259213
**Category:** Logstash
**Created:** [December 21, 2020, 5:40am UTC](https://discuss.elastic.co/t/add-date-config-make-logstash-not-working/259213 "2020-12-21T05:40:36Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![azteker](https://avatars.discourse-cdn.com/v4/letter/a/aca169/32.png) [@azteker](https://discuss.elastic.co/u/azteker)
#### Post date: [December 21, 2020, 5:40am UTC](https://discuss.elastic.co/t/add-date-config-make-logstash-not-working/259213/1 "2020-12-21T05:40:37Z")

</div>

I add date{} config into filter {}, but then the log is not passed to elasticseatch(cannot see new log in kibana). Logs are back if I removed the date config.  
This is the date config I added:

```auto
date {
     match => ["ts" , "UNIX"]
     target => "ts"
}

```

'ts' field is an integer number representing timestamp.  
This is the error log

```auto
[WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-vm-metrics-2020.12.21", :_type=>"doc", :routing=>nil}, #<LogStash::Event:0x7179472d>], :response=>{"index"=>{"_index"=>"logstash-vm-metrics-2020.12.21", "_type"=>"doc", "_id"=>"SThbhHYBTmkvgweLvH9p", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [ts] of type [long] in document with id 'SThbhHYBTmkvgweLvH9p'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"For input string: \"2020-12-21T08:12:48.000Z\""}}}}}

```

It has no error when outputting to console, but only in indexing to ES.  
I have no clues why it failed.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 21, 2020, 4:43pm UTC](https://discuss.elastic.co/t/add-date-config-make-logstash-not-working/259213/2 "2020-12-21T16:43:07Z")

</div>

> [@azteker](#):
>
> `"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [ts] of type [long] in document with id 'SThbhHYBTmkvgweLvH9p'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"For input string: \"2020-12-21T08:12:48.000Z\""}}}}}`

So the date filter successfully parsed the value of [ts] and replaced it with `"2020-12-21T08:12:48.000Z"`. However, elasticsearch, because you indexed some documents without the date filter, expects [ts] to be a 'long'. In elasticsearch a field has to have the same type on every document. It cannot be a long on some documents and a date on others.

You could change the name of the target field in the date filter, or create a new index, in which case elasticsearch will auto-detect that the field is a date.

---

<div class="post-metadata">

### Author: ![azteker](https://avatars.discourse-cdn.com/v4/letter/a/aca169/32.png) [@azteker](https://discuss.elastic.co/u/azteker)
#### Post date: [December 21, 2020, 7:08pm UTC](https://discuss.elastic.co/t/add-date-config-make-logstash-not-working/259213/3 "2020-12-21T19:08:56Z")

</div>

I have deleted the index and let the logs to be imported again, but the 'ts' field is still not treated as Date type but number type (only parse the year 2020), and I cannot change it in Kibana.  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/f/bff69243dd6f547bf49eaaabe1c398091a0df705.png)

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 21, 2020, 7:29pm UTC](https://discuss.elastic.co/t/add-date-config-make-logstash-not-working/259213/4 "2020-12-21T19:29:29Z")

</div>

Do you have a template?

---

<div class="post-metadata">

### Author: ![azteker](https://avatars.discourse-cdn.com/v4/letter/a/aca169/32.png) [@azteker](https://discuss.elastic.co/u/azteker)
#### Post date: [December 21, 2020, 7:30pm UTC](https://discuss.elastic.co/t/add-date-config-make-logstash-not-working/259213/5 "2020-12-21T19:30:16Z")

</div>

what do you mean template

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 21, 2020, 7:36pm UTC](https://discuss.elastic.co/t/add-date-config-make-logstash-not-working/259213/6 "2020-12-21T19:36:13Z")

</div>

I am referring to [index templates](https://www.elastic.co/guide/en/elasticsearch/reference/7.10/index-templates.html).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 18, 2021, 7:36pm UTC](https://discuss.elastic.co/t/add-date-config-make-logstash-not-working/259213/7 "2021-01-18T19:36:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
