# Could not index event to Elasticsearch. {:status=\>400, :action=\> #\\], :response=\>{"index"=\>ception", "reason"=\>"failed to parse date field **URL:** https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-status-400-action-logstash-0x458fc470-response-index-ception-reason-failed-to-parse-date-field/233313 **Category:** Logstash **Created:** [May 19, 2020, 12:16pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-status-400-action-logstash-0x458fc470-response-index-ception-reason-failed-to-parse-date-field/233313 "2020-05-19T12:16:53Z") **Posts on this page:** 5 **Page:** 1
### Author: ![ranjini](https://avatars.discourse-cdn.com/v4/letter/r/898d66/32.png) [@ranjini](https://discuss.elastic.co/u/ranjini) #### Post date: [May 19, 2020, 12:16pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-status-400-action-logstash-0x458fc470-response-index-ception-reason-failed-to-parse-date-field/233313/1 "2020-05-19T12:16:54Z")
[2020-05-18T09:02:52,095][WARN][logstash.outputs.amazonelasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"gppepo-epo-govpp-scheduler-2020.05.18", :\_type=\>"\_doc", :\_routing=\>nil}, #LogStash::Event:0x458fc470], :response=\>{"index"=\>{"\_index"=\>"\*\*\*\*\*\*\*\*\*\*\*\*\*-2020.05.18", "\_type"=\>"\_doc", "\_id"=\>"3aQFJ3IBhXn70-zjgi-5", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field [logtimeStamp] of type [date] in document with id '3aQFJ3IBhXn70-zjgi-5'", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"failed to parse date field [17/May/2020:23:32:43 +0000] with format [strict\_date\_optional\_time||epoch\_millis]", "caused\_by"=\>{"type"=\>"date\_time\_parse\_exception", "reason"=\>"date\_time\_parse\_exception: Failed to parse with all enclosed parsers"}}}}}} [2020-05-18T09:02:52,119][WARN][logstash.outputs.amazonelasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"g\*\*\*\*\*\*\*\*\*\*\*\*\*\*-\*\*\*\*r-2020.05.18", :\_type=\>"\_doc", :\_routing=\>nil}, #LogStash::Event:0x458fc470], :response=\>{"index"=\>{"\_index"=\>"\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*scheduler-2020.05.18", "\_type"=\>"\_doc", "\_id"=\>"5KQFJ3IBhXn70-zjgi\_O", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field [logtimeStamp] of type [date] in document with id '5KQFJ3IBhXn70-zjgi\_O'", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"failed to parse date field [17/May/2020:23:32:43 +0000] with format [strict\_date\_optional\_time||epoch\_millis]", "caused\_by"=\>{"type"=\>"date\_time\_parse\_exception", "reason"=\>"date\_time\_parse\_exception: Failed to parse with all enclosed parsers"}}}}}} 1. Can we ignore the above warning ignored? 2. If the events are not parsed so they appear in ELASTIC SEARCH ? 3. Both the servers have same logstash and ES version. All of then have same logstash conf files only in few I m noticing the above warning. please help? ---
### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger) #### Post date: [May 19, 2020, 2:26pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-status-400-action-logstash-0x458fc470-response-index-ception-reason-failed-to-parse-date-field/233313/2 "2020-05-19T14:26:54Z")
> [@ranjini](#): > > "reason"=\>"failed to parse date field [17/May/2020:23:32:43 +0000] with format [strict\_date\_optional\_time||epoch\_millis]" elasticsearch is returning this error to logstash. It does not index the document, so you are losing data. The default date parser in elasticsearch accepts two formats, one is a number of milliseconds since the 1-1-1970 (epoch\_millis). For the other "`year_month_day` format, is mandatory and the time, separated by `T` , is optional. Examples: `yyyy-MM-dd'T'HH:mm:ss.SSSZ` or `yyyy-MM-dd`. 17/May/2020:23:32:43 +0000 does not match either of those, so elasticsearch is unable to parse it. You need to use a date filter in logstash to parse the field. ---
### Author: ![ranjini](https://avatars.discourse-cdn.com/v4/letter/r/898d66/32.png) [@ranjini](https://discuss.elastic.co/u/ranjini) #### Post date: [May 20, 2020, 6:56am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-status-400-action-logstash-0x458fc470-response-index-ception-reason-failed-to-parse-date-field/233313/3 "2020-05-20T06:56:13Z")
Thank you Badger for the solution. I have the below in conf file. if "\_grokparsefailure" in [tags] { mutate { remove\_tag =\> ["\_grokparsefailure"] add\_tag =\> [" parsefailure "] } } if logstash is not able to parse the logs. They will still appear in kibana right with parsefailure. ---
### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger) #### Post date: [May 20, 2020, 4:01pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-status-400-action-logstash-0x458fc470-response-index-ception-reason-failed-to-parse-date-field/233313/4 "2020-05-20T16:01:09Z")
> [@ranjini](#): > > if logstash is not able to parse the logs. They will still appear in kibana right with parsefailure If logstash is unable to parse the logs they will still appear. If elasticsearch is unable to parse the logs they will be lost. ---
### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system) #### Post date: [June 17, 2020, 4:01pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-status-400-action-logstash-0x458fc470-response-index-ception-reason-failed-to-parse-date-field/233313/5 "2020-06-17T16:01:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.