# Date extract in elastic is showing as String Type and NOT Date

**URL:** https://discuss.elastic.co/t/date-extract-in-elastic-is-showing-as-string-type-and-not-date/227075
**Category:** Elasticsearch
**Created:** [April 8, 2020, 8:06am UTC](https://discuss.elastic.co/t/date-extract-in-elastic-is-showing-as-string-type-and-not-date/227075 "2020-04-08T08:06:30Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Praveen\_V](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/praveen_v/32/60224_2.png) [@Praveen\_V](https://discuss.elastic.co/u/Praveen_V)
#### Post date: [April 8, 2020, 8:06am UTC](https://discuss.elastic.co/t/date-extract-in-elastic-is-showing-as-string-type-and-not-date/227075/1 "2020-04-08T08:06:31Z")

</div>

Extract is working fine , however this is still represented as String rather than Date..  
Any help here would be much appreciated

Sample data : 2020-04-06 05:16:36: test again

```auto
curl -X PUT "localhost:9200/_ingest/pipeline/fields_extraction?pretty" -H 'Content-Type: application/json' -d'
{
    "description" : "parsing the input log to fields",
    "processors" : [
      {
        "dissect" : {
          "field" : "message",
          "pattern" : "%{event_created}: %{log_output}",
          "on_failure" : [
            {
              "set" : {
                "field" : "field_parse_error",
                "value" : "{{ _ingest.on_failure_message }}"
              }
            }
          ]
        }
      },
      {
        "date" : {
          "field" : "event_created",
          "target_field" : "event_datetime",
          "formats" : [
            "YYYY-MM-dd HH:mm:ss"
          ],
          "timezone" : "Europe/London",
          "on_failure" : [
            {
              "set" : {
                "field" : "date_parse_error",
                "value" : "{{ _ingest.on_failure_message }}"
              }
            }
          ]
        }
      }
    ]
 }' 

```

---

<div class="post-metadata">

### Author: ![oneoneonepig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oneoneonepig/32/66018_2.png) [@oneoneonepig](https://discuss.elastic.co/u/oneoneonepig)
#### Post date: [April 8, 2020, 8:42am UTC](https://discuss.elastic.co/t/date-extract-in-elastic-is-showing-as-string-type-and-not-date/227075/2 "2020-04-08T08:42:13Z")

</div>

My datatype for field "event\_datatime" is date using your ingest pipeline.

Probably because when you first create the index using the pipeline, you've used an incorrect input, which produces a parsing error. After the initial incorrect attempt, the field type "event\_created" will be determined as text.

Could you delete the index and try again?

This is the process I use for testing your case:

```auto
PUT _ingest/pipeline/fields_extraction?pretty
{
  "description": "parsing the input log to fields",
  "processors": [
    {
      "dissect": {
        "field": "message",
        "pattern": "%{event_created}: %{log_output}",
        "on_failure": [
          {
            "set": {
              "field": "field_parse_error",
              "value": "{{ _ingest.on_failure_message }}"
            }
          }
        ]
      }
    },
    {
      "date": {
        "field": "event_created",
        "target_field": "event_datetime",
        "formats": [
          "YYYY-MM-dd HH:mm:ss"
        ],
        "timezone": "Europe/London",
        "on_failure": [
          {
            "set": {
              "field": "date_parse_error",
              "value": "{{ _ingest.on_failure_message }}"
            }
          }
        ]
      }
    }
  ]
}

DELETE test
POST test/_doc?pipeline=fields_extraction
{
  "message": "2020-04-06 05:16:36: test again"
}

GET test/_search
GET test/_mapping

```

And this is the attempt which uses an incorrect format as input

```auto
DELETE test2
POST test2/_doc?pipeline=fields_extraction
{
  "message": "2020-04-06 05:16:366: test again"
}

GET test2/_search
GET test2/_mapping

```

---

<div class="post-metadata">

### Author: ![Praveen\_V](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/praveen_v/32/60224_2.png) [@Praveen\_V](https://discuss.elastic.co/u/Praveen_V)
#### Post date: [April 9, 2020, 7:10am UTC](https://discuss.elastic.co/t/date-extract-in-elastic-is-showing-as-string-type-and-not-date/227075/3 "2020-04-09T07:10:40Z")

</div>

Thanks for the awesome tip , i deleted and reloaded with correct data and is worked fine.

However this seems to be not correct rite.. so for instance now its working fine and if i load incorrect format will it go wrong again or its just first record after index is created ?

Thanks  
Praveen

---

<div class="post-metadata">

### Author: ![oneoneonepig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oneoneonepig/32/66018_2.png) [@oneoneonepig](https://discuss.elastic.co/u/oneoneonepig)
#### Post date: [April 9, 2020, 7:14am UTC](https://discuss.elastic.co/t/date-extract-in-elastic-is-showing-as-string-type-and-not-date/227075/4 "2020-04-09T07:14:20Z")

</div>

It will stay the same after the first index. Dynamic mapping happens in the first time the field is created.

Also, if there is a parsing error, the incorrect document will have a field named "date\_parse\_error" and the parsing error message will be stored in it.

> [@Praveen\_V](#):
>
> Thanks for the awesome tip , i deleted and reloaded with correct data and is worked fine.
> 
> However this seems to be not correct rite.. so for instance now its working fine and if i load incorrect format will it go wrong again or its just first record after index is created ?
> 
> Thanks  
> Praveen

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 7, 2020, 7:14am UTC](https://discuss.elastic.co/t/date-extract-in-elastic-is-showing-as-string-type-and-not-date/227075/5 "2020-05-07T07:14:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
