# Elastic Agent error with event.created & event.ingested

**URL:** <https://discuss.elastic.co/t/elastic-agent-error-with-event-created-event-ingested/311927>\
**Category:** Elastic Agent\
**Tags:** ingest-pipeline\
**Created:** [August 11, 2022, 1:03pm UTC](https://discuss.elastic.co/t/elastic-agent-error-with-event-created-event-ingested/311927 "2022-08-11T13:03:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [August 11, 2022, 1:03pm UTC](https://discuss.elastic.co/t/elastic-agent-error-with-event-created-event-ingested/311927/1 "2022-08-11T13:03:41Z")

</div>

I am in the process of migrating from self-managed beats to Elastic Agent. I'm currently monitoring an application log in filebeat, which I'm migrating to a Custom Log in Elastic Agent. The log is ingesting as expected. My Elasticsearch Ingest Pipeline contains the following processors:

```json
{
    "description": "Process MyApp logs",
    "processors": [
      {
        "rename": {
          "description": "Set event.created",
          "field": "@timestamp",
          "target_field": "event.created",
          "ignore_failure": true
        }
      },
      {
        "set": {
          "description": "Set event.ingested",
          "field": "event.ingested",
          "value": "{{ _ingest.timestamp }}",
          "ignore_failure": true
        }
      }
    ]
}

```

This works fine with filebeat and the processor runs successfully when using it with Elastic Agent. However, when I try to **view** these logs after ingesting them from Elastic Agent, I get the following error in Kibana:

```json
{
    "took": 1802,
    "timed_out": false,
    "_shards": {
      "total": 1260,
      "successful": 1259,
      "skipped": 1230,
      "failed": 1,
      "failures": [
        {
          "shard": 0,
          "index": ".ds-logs-my_app-default-2022.08.10-000001",
          "node": "jYPwOQtFQZ-mXZpqHFCn5Q",
          "reason": {
            "type": "illegal_argument_exception",
            "reason": "error fetching [event.created]: Field [event.created] of type [keyword] doesn't support formats.",
            "caused_by": {
              "type": "illegal_argument_exception",
              "reason": "Field [event.created] of type [keyword] doesn't support formats."
            }
          }
        }
      ]
    },
    "hits": {
      "max_score": null,
      "hits": []
    }
  }

```

I do not receive this error when viewing logs ingested through Filebeat. When I go in and **look** at the index definition, I see that both `event.created` and `event.ingested` are defined in the index as type `keyword`. According to the Elastic Common Schema, they **should** be type `date`.

I'm placing this here because it seems to be an issue with either Elastic Agent itself or with the templates that are being loaded into Kibana, rather than a Kibana issue.

Is this something I'm doing wrong, or is this a bug?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 8, 2022, 1:03pm UTC](https://discuss.elastic.co/t/elastic-agent-error-with-event-created-event-ingested/311927/2 "2022-09-08T13:03:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.