# Convert string field into Date field **URL:** \ **Category:** Logstash\ **Created:** [December 10, 2019, 9:56am UTC](https://discuss.elastic.co/t/convert-string-field-into-date-field/211266 "2019-12-10T09:56:17Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Ahmed\_Rezgui](https://avatars.discourse-cdn.com/v4/letter/a/e9a140/32.png) [@Ahmed\_Rezgui](https://discuss.elastic.co/u/Ahmed_Rezgui)\ **Post date:** [December 10, 2019, 9:56am UTC](https://discuss.elastic.co/t/convert-string-field-into-date-field/211266/1 "2019-12-10T09:56:17Z")
Hello Everyone I'm trying to index emails into elasticsearch with logstash, the problem is that two fields of the outputs are parsed as String fields but they are supposed to be "date" fields. The format of the fields is as below : "x-dbworld-deadline" =\> "31-Jul-2019" "x-dbworld-start-date" =\> "18-Nov-2019" ![config](https://us1.discourse-cdn.com/elastic/original/3X/1/c/1cdd4ce784b5220872eb39bd9881814c984add04.jpeg) How can I convert these two fields into date fields ? You will find attached my config file ---
**Author:** ![tritri](https://avatars.discourse-cdn.com/v4/letter/t/c68b51/32.png) [@tritri](https://discuss.elastic.co/u/tritri)\ **Post date:** [December 10, 2019, 10:46am UTC](https://discuss.elastic.co/t/convert-string-field-into-date-field/211266/2 "2019-12-10T10:46:25Z")
To add datetime values to your messages, use the Datetime plugin. To your filter section, add: ``` date { match => ["x-dbworld-deadline", "dd-MMM-yyyy"] match => ["x-dbworld-start-date", "dd-MMM-yyyy"] } ``` This will search for the fields you defined in your grok pattern, and create a date field. As a sidenote, you may have to install the datetime plugin first: [https://www.elastic.co/guide/en/logstash/current/working-with-plugins.html](https://www.elastic.co/guide/en/logstash/current/working-with-plugins.html) ---
**Author:** ![Ahmed\_Rezgui](https://avatars.discourse-cdn.com/v4/letter/a/e9a140/32.png) [@Ahmed\_Rezgui](https://discuss.elastic.co/u/Ahmed_Rezgui)\ **Post date:** [December 18, 2019, 10:44am UTC](https://discuss.elastic.co/t/convert-string-field-into-date-field/211266/3 "2019-12-18T10:44:11Z")
Thanks for your response. When I tried to execute my config file, I got this error : ![error_running](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e5baf9290e6f3d3118b502b3db8f491e28c544f7.png) Here is my config file after adding the datetime values ![config](https://us1.discourse-cdn.com/elastic/original/3X/3/4/3471d3fa8b5c4974dad4c5bceda97b63a7514969.png) Can someone help me please to solve this issue ? Thanks 🙂 ---
**Author:** ![ITIC](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@ITIC](https://discuss.elastic.co/u/ITIC)\ **Post date:** [December 18, 2019, 10:54am UTC](https://discuss.elastic.co/t/convert-string-field-into-date-field/211266/4 "2019-12-18T10:54:59Z")
Hi I don't think you can have duplicate parameters in one single filter. I'd reccomend you split your `date{}` filter in two, one for each field. Hope this helps. ---
**Author:** ![Ahmed\_Rezgui](https://avatars.discourse-cdn.com/v4/letter/a/e9a140/32.png) [@Ahmed\_Rezgui](https://discuss.elastic.co/u/Ahmed_Rezgui)\ **Post date:** [December 18, 2019, 1:51pm UTC](https://discuss.elastic.co/t/convert-string-field-into-date-field/211266/5 "2019-12-18T13:51:06Z")
I tried what you recommended, the config file is now as below : ![config_file](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f411a7ff77322ef85b60419173d68e1b8ae52020.png) Now I have another problem, this keeps running non-stop : ![error](https://us1.discourse-cdn.com/elastic/original/3X/b/7/b76dde4d79ded402a786be46f8fe0a5bed9332a4.png) Any idea please ? ---
**Author:** ![ITIC](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@ITIC](https://discuss.elastic.co/u/ITIC)\ **Post date:** [December 18, 2019, 1:57pm UTC](https://discuss.elastic.co/t/convert-string-field-into-date-field/211266/6 "2019-12-18T13:57:28Z")
Hi Never used `imap{}` input, so you'll have to check its parameters, but you seem to be getting an "invalid credentials" error, and logstash just keeps trying. Besides, you have a `check_interval => 10` parameter, so I guess logstash will check your imap account every 10 seconds (when you get your credentials right). Other than that, I don't know why it keeps running non-stop. ---
**Author:** ![Ahmed\_Rezgui](https://avatars.discourse-cdn.com/v4/letter/a/e9a140/32.png) [@Ahmed\_Rezgui](https://discuss.elastic.co/u/Ahmed_Rezgui)\ **Post date:** [December 19, 2019, 1:54pm UTC](https://discuss.elastic.co/t/convert-string-field-into-date-field/211266/7 "2019-12-19T13:54:08Z")
Even when I tried to take off the parameter check\_interval, it show the same errors ![error_screen](https://us1.discourse-cdn.com/elastic/original/3X/4/5/453d345fc42c6a046605c1f457ea4bfdf06ddeb6.png) Can someone help me with this please ? ---
**Author:** ![ITIC](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@ITIC](https://discuss.elastic.co/u/ITIC)\ **Post date:** [December 20, 2019, 7:46am UTC](https://discuss.elastic.co/t/convert-string-field-into-date-field/211266/8 "2019-12-20T07:46:13Z")
Hi All I see in your snippet of the logs is that your IMAP is not responding due to invalid credentials, and logstash simply keeps trying. ---
**Author:** ![Ahmed\_Rezgui](https://avatars.discourse-cdn.com/v4/letter/a/e9a140/32.png) [@Ahmed\_Rezgui](https://discuss.elastic.co/u/Ahmed_Rezgui)\ **Post date:** [December 20, 2019, 9:37am UTC](https://discuss.elastic.co/t/convert-string-field-into-date-field/211266/9 "2019-12-20T09:37:41Z")
I resolved the problem I just had to allow less secure apps to access my Gmail account like this : ![secureapp](https://us1.discourse-cdn.com/elastic/original/3X/9/b/9b66579b266940012e1a1fc39cedfe4bb45f0a35.png) Thanks 😃 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 17, 2020, 9:37am UTC](https://discuss.elastic.co/t/convert-string-field-into-date-field/211266/10 "2020-01-17T09:37:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.