# Convert field containing a timestamp from string to a date / time or timestamp?

**URL:** <https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594>\
**Category:** Logstash\
**Created:** [February 26, 2021, 10:26am UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594 "2021-02-26T10:26:02Z")\
**Posts on this page:** 9\
**Page:** 3

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [March 4, 2021, 3:22pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/41 "2021-03-04T15:22:13Z")

</div>

Oh yeah sorry....Used a old screenshot

---

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [March 5, 2021, 2:12pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/42 "2021-03-05T14:12:39Z")

</div>

I tried this:

> **[PUT \_index\_template/myindex-template{ "index\_patterns": \["myindex-\*" -...](https://pastebin.com/vmWfZU99)**
>
> Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

But it errors:

```
{
  "error" : {
    "root_cause" : [
      {
        "type" : "x_content_parse_exception",
        "reason" : "[5:3] [index_template] unknown field [mappings]"
      }
    ],
    "type" : "x_content_parse_exception",
    "reason" : "[5:3] [index_template] unknown field [mappings]"
  },
  "status" : 400
}

```

Thought that would have done the trick

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [March 5, 2021, 2:17pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/43 "2021-03-05T14:17:47Z")

</div>

Your structure looks wrong. Do a `GET _index_template/` and you can see all the other templates and use the same structure they use.

If you are still having issues I would open a new topic with that specific error you are encountering.

---

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [March 5, 2021, 2:24pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/44 "2021-03-05T14:24:04Z")

</div>

Yeah I see the structure but the issue is that I dont know which is the DEFAULT one that is being applied ..... Elastic Stack does not make that clear for some reason.

These are all the index templates I have after doing a GET \_index\_template/

> **[{ "index\_templates" : \[{ "name" : "metrics-system.process", -...](https://pastebin.com/bd0jzac9)**
>
> Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

In there, there should be one related to logstash correct?

---

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [March 5, 2021, 2:41pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/45 "2021-03-05T14:41:10Z")

</div>

OK, I sorta figured it out

0: Stop logstash  
1: Delete index data  
2: Delete index pattern  
3: Start logstash  
4: Generate data  
5: Generate index pattern  
6: Open Dev Tools and

```
PUT _index_template/your-index-name-template
{
  "index_patterns": ["your-index-name--*"],
  "template": {
    "mappings": {
      "properties": {
        "OneFieldWithDate": {
          "type": "date"
        },
		 "AnotherFieldWithDate": {
          "type": "date"
        }
      }
    }
  }
}

```

6: See data added  
7: Stop logstash  
8: Delete Index data  
9: Delete Kibana data  
10: Open Dev Tools and

```
PUT _index_template/your-index-name-template
{
  "index_patterns": ["your-index-name--*"],
  "template": {
    "mappings": {
      "properties": {
        "OneFieldWithDate": {
          "type": "date"
        },
		 "AnotherFieldWithDate": {
          "type": "date"
        }
      }
    }
  }
}

```

11: Start logstash  
12: Generate data  
13: Create Kibana index

Now I am getting the field in date....

Way way way too weird

---

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [March 9, 2021, 4:54pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/46 "2021-03-09T16:54:52Z")

</div>

I have been able to cut it down to less steps 🙂

Thats being said, I want to explore if there are other ways to do it: More specifically without deleting older data.

Ive thought about SQL where you can technically do a alter table and that allows you to change the column type.

Does anything like this exist for Elasticsearch indexes?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 9, 2021, 5:04pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/47 "2021-03-09T17:04:52Z")

</div>

> [@riahc3](#):
>
> Thats being said, I want to explore if there are other ways to do it: More specifically without deleting older data.
> 
> Ive thought about SQL where you can technically do a alter table and that allows you to change the column type.

Once a field type is set in elasticsearch it cannot be changed. You would need to create a new index, apply a template that sets the field types you want, then copy the data from the old index to the new. The [reindex](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html) API might be useful for that.

---

<div class="post-metadata">

**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\
**Post date:** [March 9, 2021, 5:34pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/48 "2021-03-09T17:34:55Z")

</div>

My indexes are created daily (for example: adlogins-2021-03-09, adlogins-2021-03-10, etc). Is there a way to do it this way?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 6, 2021, 5:35pm UTC](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594/49 "2021-04-06T17:35:38Z")

</div>

Closed on April 6, 2021, 5:35pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/convert-field-containing-a-timestamp-from-string-to-a-date-time-or-timestamp/265594.md?page=2)