# Discover: Field data loading is forbidden on \[loggingTime\]
**URL:** https://discuss.elastic.co/t/discover-field-data-loading-is-forbidden-on-loggingtime/89452
**Category:** Logstash
**Created:** [June 14, 2017, 8:18pm UTC](https://discuss.elastic.co/t/discover-field-data-loading-is-forbidden-on-loggingtime/89452 "2017-06-14T20:18:20Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Honda\_fred\_elk](https://discuss.elastic.co/u/Honda_fred_elk)
#### Post date: [June 14, 2017, 8:18pm UTC](https://discuss.elastic.co/t/discover-field-data-loading-is-forbidden-on-loggingtime/89452/1 "2017-06-14T20:18:20Z")
Hello,
I use Filebeat to export JSON String to --\> logstash --\> elasticsearch --\> Kibana
My application's log4j creates each log as JSON String like below.. it has loggingTime key & pair which is actual timestamp of that log message.
{"loggingTime":"Wed 14 Jun 2017 15-03-49 126 EDT","applicationName":"LOT\_CONTROL\_SIM\_2","hostName":"[VNWQ63213.hmin.am.honda.com](http://VNWQ63213.hmin.am.honda.com)","clientName":"LOT\_CONTROL\_SIM\_2","loglevel":"INFO","logMessage":"Successfully played clip: Buzzer.wav"}
Logstash adds @timestamp in which there is a difference between actual loggingTime and @timestamp.. so I don't want to use it. logically @timestamp is a message received timestamp from logstash.
{"type":"client\_log","loggingTime":"Wed 14 Jun 2017 15-03-49 126 EDT","applicationName":"LOT\_CONTROL\_SIM\_2","@timestamp":"2017-06-14T19:03:54.338Z","beat":{"name":"VNWQ63213","hostname":"VNWQ63213","version":"5.1.2"},"loglevel":"INFO","source":"/read-write/mnt/addons/GALCClientLogs/client-jsonoutput.log","offset":4157264,"logMessage":"Successfully played clip: Buzzer.wav","hostName":"[VNWQ63213.hmin.am.honda.com](http://VNWQ63213.hmin.am.honda.com)","clientName":"LOT\_CONTROL\_SIM\_2","input\_type":"log","@version":"1","host":"VNWQ63213","tags":["beats","beats\_input\_raw\_event"]}
But when I see the output through Kibana.. I see loggingTime as string type. Also When I tried to sort loggingTime field in Discover page in Kibana I'm getting below error and I am not able to sort the logs based on loggingTime field
**Discover: Field data loading is forbidden on [loggingTime]**
I want to have loggingTime field as as sortable field based on its timestamp. This will add value to the users, when they try to connect actual logs with timestamp to narrow down for issues.
So I want to have loggingTime field as sortable in kibana, How can I achieve this?
Thanks
Fredrick
---
### Author:  [@Honda\_fred\_elk](https://discuss.elastic.co/u/Honda_fred_elk)
#### Post date: [June 15, 2017, 2:21pm UTC](https://discuss.elastic.co/t/discover-field-data-loading-is-forbidden-on-loggingtime/89452/2 "2017-06-15T14:21:19Z")
I read that It could be done by overriding @timestamp through logstash filter plugin date.. I solved this issue by having following settings in the logstash config file
filter{
date{
locale =\> "en"
match =\> ["loggingTime","EEE d MMM yyyy HH-mm-ss SSS z"]
target =\> "@timestamp"
}
}
After this .. I can sort time column is nothing but @timestamp field in Kibana .. and verified both values are same..
My problem is resolved
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 13, 2017, 2:21pm UTC](https://discuss.elastic.co/t/discover-field-data-loading-is-forbidden-on-loggingtime/89452/3 "2017-07-13T14:21:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.