# Date type fields not being created though date format conversion works

**URL:** https://discuss.elastic.co/t/date-type-fields-not-being-created-though-date-format-conversion-works/256709
**Category:** Logstash
**Created:** [November 25, 2020, 7:51pm UTC](https://discuss.elastic.co/t/date-type-fields-not-being-created-though-date-format-conversion-works/256709 "2020-11-25T19:51:59Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Chris\_Stone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chris_stone/32/21026_2.png) [@Chris\_Stone](https://discuss.elastic.co/u/Chris_Stone)
#### Post date: [November 25, 2020, 7:51pm UTC](https://discuss.elastic.co/t/date-type-fields-not-being-created-though-date-format-conversion-works/256709/1 "2020-11-25T19:51:59Z")

</div>

Hi, I am collecting http access logs and wanting to place some date headers into date type fields. I've tried a couple of things, shown below, but while the date format is converted properly, the resulting field is still of type `keyword`, rather than `date`.

To be clear, I'm receiving RFC 1123 formatted dates and they are being converted to the Elasticsearch date format (right?):

`Wed, 25 Nov 2020 19:24:27 GMT` ---\> `2020-11-25T19:24:27.000Z`

But the resulting field is still a string type.

```
date{
  match => ["[respHdr][date]", "EEE, dd MMM yyyy HH:mm:ss zzz"]
  target => "[http][response][date]"
  remove_field => ["[respHdr][date]" ]
}

date{
  match => ["[http][response][expires]", "EEE, dd MMM yyyy HH:mm:ss zzz"]
  target => "[http][response][expires]"
}

```

I do see that placing a date into `@timestamp` (the default target) works fine:

```
   date{
    match => ["start", "UNIX"]
  }

```

I have deleted the index and started from fresh each time, but am seeing the same behavior. I'm using the ecs-logstash index template and ELK 7.10.

I see that `date_detection` is `false` by default in the ECS template, but not sure if that's the issue.

I'd appreciate any pointers on getting this to work and am happy to provide any further needed information.

Thanks,

--Chris

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 25, 2020, 8:06pm UTC](https://discuss.elastic.co/t/date-type-fields-not-being-created-though-date-format-conversion-works/256709/2 "2020-11-25T20:06:38Z")

</div>

> [@Chris\_Stone](#):
>
> I see that `date_detection` is `false` by default in the ECS template, but not sure if that's the issue.

I believe it is. If you index template does not map the field as a date and date\_detection is disabled I cannot think of a way the field would get mapped as a date.

---

<div class="post-metadata">

### Author: ![Chris\_Stone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chris_stone/32/21026_2.png) [@Chris\_Stone](https://discuss.elastic.co/u/Chris_Stone)
#### Post date: [November 25, 2020, 8:21pm UTC](https://discuss.elastic.co/t/date-type-fields-not-being-created-though-date-format-conversion-works/256709/3 "2020-11-25T20:21:50Z")

</div>

Thanks! So I guess it would be a question for the elasticsearch forum about whether changing this to `true` would be a bad thing, or if there's anything else I can do...

Thanks again,

--Chris

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 23, 2020, 8:22pm UTC](https://discuss.elastic.co/t/date-type-fields-not-being-created-though-date-format-conversion-works/256709/4 "2020-12-23T20:22:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.