# Elastic SIEM "Data Fetch Failure Invalid time value" **URL:** \ **Category:** SIEM\ **Tags:** ecs-elastic-common-schema\ **Created:** [September 21, 2020, 3:33pm UTC](https://discuss.elastic.co/t/elastic-siem-data-fetch-failure-invalid-time-value/249388 "2020-09-21T15:33:26Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![soufiane\_adn](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@soufiane\_adn](https://discuss.elastic.co/u/soufiane_adn)\ **Post date:** [September 21, 2020, 3:33pm UTC](https://discuss.elastic.co/t/elastic-siem-data-fetch-failure-invalid-time-value/249388/1 "2020-09-21T15:33:26Z")
Hello guys, i hope you are doing well, so i'm facing a problem on the elastic siem app after parsing my logs and migrating them to ecs by logstash. the problem is the following error on the host/ event view : **Data Fetch Failure** **Invalid time value** but not on all my indexes just one of them i tried to rebuild timestamps but i still have this error. if just someone could tell me the source of this one ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/b/9b6852150bb68cb9bd3983a2c0b6cb0714382dc2.png) thanks in the advance ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [September 21, 2020, 3:43pm UTC](https://discuss.elastic.co/t/elastic-siem-data-fetch-failure-invalid-time-value/249388/2 "2020-09-21T15:43:00Z")
We are not all guys here 🙂 Make sure all indexes used by SIEM app all have @timestamp field of type date Under Stack Management \>\> Advanced Setting ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/e/9e81feef4f70242d7da2869001eb77281d696a3c.png) ---
**Author:** ![soufiane\_adn](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@soufiane\_adn](https://discuss.elastic.co/u/soufiane_adn)\ **Post date:** [September 21, 2020, 4:50pm UTC](https://discuss.elastic.co/t/elastic-siem-data-fetch-failure-invalid-time-value/249388/3 "2020-09-21T16:50:47Z")
Hi Yassine, thanks but the thing is all my indices have type date for the @timestamp field (same mapping) ---
**Author:** ![borna\_talebi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/borna_talebi/32/76317_2.png) [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Post date:** [September 21, 2020, 5:30pm UTC](https://discuss.elastic.co/t/elastic-siem-data-fetch-failure-invalid-time-value/249388/4 "2020-09-21T17:30:37Z")
Can you post an example? maybe it's a format problem? ---
**Author:** ![soufiane\_adn](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@soufiane\_adn](https://discuss.elastic.co/u/soufiane_adn)\ **Post date:** [September 23, 2020, 11:16am UTC](https://discuss.elastic.co/t/elastic-siem-data-fetch-failure-invalid-time-value/249388/5 "2020-09-23T11:16:58Z")
Hi borna Problem resolved. it was an unstructured event.start format Thanks ---
**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\ **Post date:** [September 25, 2020, 2:07pm UTC](https://discuss.elastic.co/t/elastic-siem-data-fetch-failure-invalid-time-value/249388/6 "2020-09-25T14:07:54Z")
Thanks for posting that your problem was solved. I really ❤ the forums because of all the users always post their solution and what solved their problems for others to see. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 23, 2020, 2:07pm UTC](https://discuss.elastic.co/t/elastic-siem-data-fetch-failure-invalid-time-value/249388/7 "2020-10-23T14:07:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.