# Data field type changed from date to text

**URL:** <https://discuss.elastic.co/t/data-field-type-changed-from-date-to-text/360046>\
**Category:** Elasticsearch\
**Created:** [May 23, 2024, 7:52am UTC](https://discuss.elastic.co/t/data-field-type-changed-from-date-to-text/360046 "2024-05-23T07:52:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Frances\_Chu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frances_chu/32/127298_2.png) [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\
**Post date:** [May 23, 2024, 7:52am UTC](https://discuss.elastic.co/t/data-field-type-changed-from-date-to-text/360046/1 "2024-05-23T07:52:47Z")

</div>

My logstash configuration file like this

After reading the csv file I change the **log\_datetime** field from "dd-MM HH:mm:ss" to "2024-05-23T01:18:07.000Z"  
by the following configuration in test.conf

```auto
date {
      match => ["log_datetime", "dd-MM HH:mm:ss"]
      timezone => "America/New_York"
      target => "log_datetime"
}

```

However, I find in my elasticsearch the log\_datetime changed to text format.

![log_datetime](https://us1.discourse-cdn.com/elastic/original/3X/f/7/f7a4c8ab2fd369c9ae4f2282070a0b8ac23f6876.png)

With the similar configuration file in logstash.  
For another source server it works fine. Any idea?

---

<div class="post-metadata">

**Author:** ![Frances\_Chu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frances_chu/32/127298_2.png) [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\
**Post date:** [May 23, 2024, 8:51am UTC](https://discuss.elastic.co/t/data-field-type-changed-from-date-to-text/360046/2 "2024-05-23T08:51:37Z")

</div>

1. I stop the filebeat service in the source server
2. remove the index in Elasticsearch
3. Move all logs in the source server's folder (folderA) to different folder (folderB)
4. Start the filebeat service in the source server
5. Copy log files from folderB to folderA in batch, each batch 10 files
6. finally everything works ..i.e. the data type keep.....date formate

Actually I don't know why? Any idea?