# Date Not Recognized **URL:** \ **Category:** Kibana\ **Created:** [August 5, 2019, 12:55pm UTC](https://discuss.elastic.co/t/date-not-recognized/193796 "2019-08-05T12:55:20Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Jim\_Palazzolo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jim_palazzolo/32/47451_2.png) [@Jim\_Palazzolo](https://discuss.elastic.co/u/Jim_Palazzolo)\ **Post date:** [August 5, 2019, 12:55pm UTC](https://discuss.elastic.co/t/date-not-recognized/193796/1 "2019-08-05T12:55:20Z")
I have json documents that are going into ES just fine, but Kibana doesn't seem to recognize this field; but it records it... ```auto "fields": { "Event.date": [ "2016-03-14T00:00:00.000Z" ``` I'm sure it's just a configuration thing or a setting, but for the life of me I can't seem to find it... Spent most of the day yesterday looking for a good guide on this. ---
**Author:** ![Jim\_Palazzolo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jim_palazzolo/32/47451_2.png) [@Jim\_Palazzolo](https://discuss.elastic.co/u/Jim_Palazzolo)\ **Post date:** [August 5, 2019, 12:58pm UTC](https://discuss.elastic.co/t/date-not-recognized/193796/2 "2019-08-05T12:58:58Z")
I did find this, but can I do this recursively after I've added the data to elasticsearch index? [https://www.elastic.co/guide/en/logstash/6.7/plugins-filters-date.html](https://www.elastic.co/guide/en/logstash/6.7/plugins-filters-date.html) ---
**Author:** ![Jim\_Palazzolo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jim_palazzolo/32/47451_2.png) [@Jim\_Palazzolo](https://discuss.elastic.co/u/Jim_Palazzolo)\ **Post date:** [August 5, 2019, 1:31pm UTC](https://discuss.elastic.co/t/date-not-recognized/193796/3 "2019-08-05T13:31:02Z")
Will try this. Not sure if will work - ```auto es.index(index='some-index', ignore=400, doc_type='docket', id=i, body=json.loads(docket_content), filter { mutate { convert => ["Event.date", "string"] } date { match => ["Event.date", "ISO8601"] target => "Event.date" } }) ``` ---
**Author:** ![jbudz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbudz/32/45922_2.png) [@jbudz](https://discuss.elastic.co/u/jbudz)\ **Post date:** [August 5, 2019, 6:33pm UTC](https://discuss.elastic.co/t/date-not-recognized/193796/4 "2019-08-05T18:33:03Z")
Yes, that should help hopefully. Kibana doesn't have great support [for nested fields](https://github.com/elastic/kibana/issues/1084) so extracting it should help. ---
**Author:** ![Jim\_Palazzolo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jim_palazzolo/32/47451_2.png) [@Jim\_Palazzolo](https://discuss.elastic.co/u/Jim_Palazzolo)\ **Post date:** [August 5, 2019, 7:41pm UTC](https://discuss.elastic.co/t/date-not-recognized/193796/5 "2019-08-05T19:41:14Z")
No i get a python error when trying this... ---
**Author:** ![Jim\_Palazzolo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jim_palazzolo/32/47451_2.png) [@Jim\_Palazzolo](https://discuss.elastic.co/u/Jim_Palazzolo)\ **Post date:** [August 5, 2019, 7:47pm UTC](https://discuss.elastic.co/t/date-not-recognized/193796/6 "2019-08-05T19:47:56Z")
also this error constantly: Discover: unknown error Less Infodownload OK SearchError: unknown error at http://:5601/bundles/commons.bundle.js:4:383522 at processQueue (h:5601/built\_assets/dlls/vendors.bundle.dll.js:450:200650 at Scope.$digest (http://:5601/built\_assets/dlls/vendors.bundle.dll.js:450:210412) at Scope.$apply (http://:5601/built\_assets/dlls/vendors.bundle.dll.js:450:213219) at done (http://:5601/built\_assets/dlls/vendors.bundle.dll.js:450:132717) at completeRequest (http://:5601/built\_assets/dlls/vendors.bundle.dll.js:450:136329) at XMLHttpRequest.requestError (http:/:5601/built\_assets/dlls/vendors.bundle.dll.js:450:135346) ---
**Author:** ![jbudz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbudz/32/45922_2.png) [@jbudz](https://discuss.elastic.co/u/jbudz)\ **Post date:** [August 5, 2019, 9:54pm UTC](https://discuss.elastic.co/t/date-not-recognized/193796/7 "2019-08-05T21:54:54Z")
`Discover: unknown error` is usually caused by something in between kibana and ES. Kibana knows how to read elasticsearch error messages, but outside of that scope it'll respond with unknown error. We should be able to open the dev tools network tab and see what the response is - sometime's it'll be empty if there's a proxy in front closing connections or so on. Regarding the fields - apologies. That should work for new data coming in, but if not it will have to be reindexed. Logstash can use elasticsearch as the input and output. Alternatively the reindex api with a painless script should be able to help. ---
**Author:** ![kumar8055](https://avatars.discourse-cdn.com/v4/letter/k/278dde/32.png) [@kumar8055](https://discuss.elastic.co/u/kumar8055)\ **Post date:** [August 6, 2019, 5:35am UTC](https://discuss.elastic.co/t/date-not-recognized/193796/8 "2019-08-06T05:35:41Z")
Hi @Jim_Palazzolo, Can you try to convert this field in python script using str(utc\_datetime.strftime('%Y-%m-%dT%H:%M:%S.%f')[:-3] before indexing into Elastic. If you need to convert the present data, the only is re-indexing Thanks Kumar ---
**Author:** ![Jim\_Palazzolo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jim_palazzolo/32/47451_2.png) [@Jim\_Palazzolo](https://discuss.elastic.co/u/Jim_Palazzolo)\ **Post date:** [August 6, 2019, 10:59am UTC](https://discuss.elastic.co/t/date-not-recognized/193796/9 "2019-08-06T10:59:20Z")
kumar here's the python i'm using to move all the json files to elasticsearch i'm assuming i could insert that bit of script into this one? ```auto import requests, json, os from elasticsearch import Elasticsearch directory = '/usr/share/logstash/misp-json-files' res = requests.get('http://IP:9200') print (res.content) es = Elasticsearch([{'host': 'IP', 'port': '9200'}]) i = 1 for filename in os.listdir(directory): if filename.endswith(".json"): f = open(filename) docket_content = f.read() # Send the data into es es.index(index='resource2', ignore=400, doc_type='docket', id=i, body=json.loads(docket_content)) i + 1 ``` ---
**Author:** ![Jim\_Palazzolo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jim_palazzolo/32/47451_2.png) [@Jim\_Palazzolo](https://discuss.elastic.co/u/Jim_Palazzolo)\ **Post date:** [August 6, 2019, 11:01am UTC](https://discuss.elastic.co/t/date-not-recognized/193796/10 "2019-08-06T11:01:20Z")
tried converting `event.date` to `string` in the index management section. didn't help... well - the error went away, but that went away after i blew away the index and started over... ---
**Author:** ![Jim\_Palazzolo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jim_palazzolo/32/47451_2.png) [@Jim\_Palazzolo](https://discuss.elastic.co/u/Jim_Palazzolo)\ **Post date:** [August 6, 2019, 11:03am UTC](https://discuss.elastic.co/t/date-not-recognized/193796/11 "2019-08-06T11:03:22Z")
also - all the ELK stuff sits on the same box, there's no proxy being used at this time. ELK version 6.8 ---
**Author:** ![kumar8055](https://avatars.discourse-cdn.com/v4/letter/k/278dde/32.png) [@kumar8055](https://discuss.elastic.co/u/kumar8055)\ **Post date:** [August 6, 2019, 3:56pm UTC](https://discuss.elastic.co/t/date-not-recognized/193796/12 "2019-08-06T15:56:27Z")
@Jim_Palazzolo In your script send an extra field . 1. get the field from the json object 2. use the formula of above ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 3, 2019, 4:11pm UTC](https://discuss.elastic.co/t/date-not-recognized/193796/13 "2019-09-03T16:11:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.