# Elasticsearch index error **URL:** \ **Category:** Elasticsearch\ **Created:** [January 10, 2021, 9:11am UTC](https://discuss.elastic.co/t/elasticsearch-index-error/260634 "2021-01-10T09:11:51Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![abu.sayeed](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Post date:** [January 10, 2021, 9:11am UTC](https://discuss.elastic.co/t/elasticsearch-index-error/260634/1 "2021-01-10T09:11:52Z")
**elasticsearch.yml** network.host: localhost http.port: 9200 transport.host: localhost transport.tcp.port: 9300 discovery.seed\_hosts: - localhost:9300 cluster.initial\_master\_nodes: - ${HOSTNAME} action.auto\_create\_index: .monitoring\*,.watches,.triggered\_watches,.watcher-history\*,.ml\* **Filebeat.yml** filebeat.inputs: - type: log enabled: true paths: #- /var/log/auth.log - /var/log/custom.log filebeat.registry.path: /var/lib/filebeat/registry filebeat.registry.file\_permissions: 0600 filebeat.shutdown\_timeout: 5s json.keys\_under\_root: true json.add\_error\_key: true output.logstash: hosts: ["localhost:5044"] ssl.certificate\_authorities: ["/etc//certs/logstash.crt"] setup.kibana: host: "localhost:5601" processors: - rename: fields: - from: "log.file.path" to: "path" ignore\_missing: false fail\_on\_error: true logging.level: info logging.to\_files: true logging.files: path: /var/log/filebeat name: filebeat keepfiles: 7 permissions: 0644 **[2021-01-10T15:02:28,890][WARN][logstash.outputs.elasticsearch][main][62fa879f9cb3d6d767fe396c109c26137c7dc5006c2178486e9ce8686fcd58c5] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"filebeat-7.10.1", :routing=\>nil, :\_type=\>"\_doc"}, #LogStash::Event:0x2f050055], :response=\>{"index"=\>{"\_index"=\>"filebeat-7.10.1-2020.12.24-000001", "\_type"=\>"\_doc", "\_id"=\>"wjmI63YBHDLDNbTjU-Dc", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field [txnDateTime] of type [keyword] in document with id 'wjmI63YBHDLDNbTjU-Dc'. Preview of field's value: '{date={month=1, year=2021, day=7}, time={hour=10, nano=0, minute=23, second=1}}'", "caused\_by"=\>{"type"=\>"illegal\_state\_exception", "reason"=\>"Can't get text on a START\_OBJECT at 1:478"}}}}}** Thanks ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 11, 2021, 12:11am UTC](https://discuss.elastic.co/t/elasticsearch-index-error/260634/2 "2021-01-11T00:11:32Z")
Please format your code/logs/config using the `` button, or markdown style back ticks. It helps to make things easy to read which helps us help you 🙂 > [@abu.sayeed](#): > > "reason"=\>"failed to parse field [txnDateTime] of type [keyword] in document with id 'wjmI63YBHDLDNbTjU-Dc'. Preview of field's value: '{date={month=1, year=2021, day=7}, time={hour=10, nano=0, minute=23, second=1}}' Specficially `Preview of field's value: '{date={month=1, year=2021, day=7}, time={hour=10, nano=0, minute=23, second=1` is not valid for that field type. You need to find what is generating this and fix it. ---
**Author:** ![abu.sayeed](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Post date:** [January 11, 2021, 2:55am UTC](https://discuss.elastic.co/t/elasticsearch-index-error/260634/3 "2021-01-11T02:55:22Z")
Thanks for reply. First time logs format was wrong. Now I logs format json type. All logs better now. But not show index. cause preview logs format was wrong. How can upgrade fields format so that any logs not lose. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 11, 2021, 4:37am UTC](https://discuss.elastic.co/t/elasticsearch-index-error/260634/4 "2021-01-11T04:37:15Z")
What does your Logstash output config look like? ---
**Author:** ![abu.sayeed](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Post date:** [January 11, 2021, 6:06am UTC](https://discuss.elastic.co/t/elasticsearch-index-error/260634/5 "2021-01-11T06:06:30Z")
Logstash output: output { elasticsearch { hosts =\> ["[http://localhost:9200](http://localhost:9200)"] index =\> "%{[@metadata][beat]}-%{[@metadata][version]}" } stdout { codec =\> rubydebug } } GET filebeat-7.10.1/\_mapping ``` "clientRequestDateTime" : { "type" : "keyword", "ignore_above" : 1024 } ``` But it will be like: ``` "clientRequestDateTime" : { "properties" : { "date" : { "properties" : { "day" : { "type" : "long" }, "month" : { "type" : "long" }, "year" : { "type" : "long" } } }, "time" : { "properties" : { "hour" : { "type" : "long" }, "minute" : { "type" : "long" }, "nano" : { "type" : "long" }, "second" : { "type" : "long" } } } } } ``` Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 8, 2021, 6:06am UTC](https://discuss.elastic.co/t/elasticsearch-index-error/260634/6 "2021-02-08T06:06:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.