# Error to map date field with format yyyy-MM-dd HH:mm:ss.SSS
**URL:** https://discuss.elastic.co/t/error-to-map-date-field-with-format-yyyy-mm-dd-hhss-sss/160341
**Category:** Logstash
**Created:** [December 11, 2018, 10:03am UTC](https://discuss.elastic.co/t/error-to-map-date-field-with-format-yyyy-mm-dd-hhss-sss/160341 "2018-12-11T10:03:30Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@balumurari1](https://discuss.elastic.co/u/balumurari1)
#### Post date: [December 11, 2018, 10:03am UTC](https://discuss.elastic.co/t/error-to-map-date-field-with-format-yyyy-mm-dd-hhss-sss/160341/1 "2018-12-11T10:03:30Z")
Hello,
can anyone help me to map the date, 2018-12-03 06:00:00.000
I have tried to give mapping to load into logstash as
yyyy-MM-dd HH:mm:ss.SSS
but getting below error
"error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [updated\_date]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Invalid format: "2018-11-21T18:30:00.000Z" is malformed at "T18:30:00.000Z""}
Thanks inadvance
---
### Author:  [@admlko](https://discuss.elastic.co/u/admlko)
#### Post date: [December 11, 2018, 10:30am UTC](https://discuss.elastic.co/t/error-to-map-date-field-with-format-yyyy-mm-dd-hhss-sss/160341/2 "2018-12-11T10:30:59Z")
It seems that your date is not 2018-12-03 06:00:00.000 but 2018-12-03T06:00:00.000 ?
If yes, then your issue is mentioned in the documentation: [Date filter plugin | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html)
> For non-formatting syntax, you’ll need to put single-quote characters around the value. For example, if you were parsing ISO8601 time, "2015-01-01T01:12:23" that little "T" isn’t a valid time format, and you want to say "literally, a T", your format would be this: "yyyy-MM-dd’T'HH:mm:ss"
So, the format should be: yyyy-MM-dd'T'HH:mm:ss.SSS.
If this didn't help, I need to see the input data, Logstash config and the error message you received.
---
### Author:  [@balumurari1](https://discuss.elastic.co/u/balumurari1)
#### Post date: [December 11, 2018, 11:02am UTC](https://discuss.elastic.co/t/error-to-map-date-field-with-format-yyyy-mm-dd-hhss-sss/160341/3 "2018-12-11T11:02:07Z")
Hello, thanks for reply
the above format didnt work for me.
The sample date format present in database for column updated\_date is as shown
2017-12-18 00:00:00.000
Here is the input code,
input {
jdbc {
jdbc\_driver\_library =\> "D:/Softwares/logstash-6.4.2/lib/sqljdbc4-2.0.jar"
jdbc\_driver\_class =\> "com.microsoft.sqlserver.jdbc.SQLServerDriver"
jdbc\_connection\_string =\> "jdbc:sqlserver:// **:** /\*\*\*"
jdbc\_user =\> "####"
jdbc\_password =\> "###"
statement =\> "SELECT id, name , updated\_date FROM sample"
jdbc\_paging\_enabled =\> "true"
jdbc\_page\_size =\> "50000"
}
}
output{
elasticsearch { codec =\> json hosts =\> ["localhost:9200"] index =\> "idx\_sqldata" }
stdout { codec =\> rubydebug }
}
# Output
Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"idx\_sqldata", :\_type=\>"\_doc", :\_routing=\>nil}, #LogStash::Event:0x613cc85f], :response=\>{"index"=\>{"\_index"=\>"idx\_sqldata", "\_type"=\>"\_doc", "\_id"=\>"bcDpnGcBu0SneeiwZGsB", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [updated\_date]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Invalid format: "2018-11-21T18:30:00.000Z" is malformed at "Z""}}}}}
---
### Author:  [@admlko](https://discuss.elastic.co/u/admlko)
#### Post date: [December 11, 2018, 11:24am UTC](https://discuss.elastic.co/t/error-to-map-date-field-with-format-yyyy-mm-dd-hhss-sss/160341/4 "2018-12-11T11:24:28Z")
As the log states, it is a mapping problem with Elasticsearch. What kind of mapping are you using for the idx\_sqldata index?
This means that the updated\_date field has been mapped to a different format than the one you are trying to pass to it.
---
### Author:  [@balumurari1](https://discuss.elastic.co/u/balumurari1)
#### Post date: [December 11, 2018, 11:26am UTC](https://discuss.elastic.co/t/error-to-map-date-field-with-format-yyyy-mm-dd-hhss-sss/160341/5 "2018-12-11T11:26:45Z")
Hello,
I am using the format as shown below,
"last\_updated\_date":{
"type":"date",
"format" : "yyyy-MM-dd'T'HH:mm:ss.SSS"
}
---
### Author:  [@admlko](https://discuss.elastic.co/u/admlko)
#### Post date: [December 11, 2018, 11:30am UTC](https://discuss.elastic.co/t/error-to-map-date-field-with-format-yyyy-mm-dd-hhss-sss/160341/6 "2018-12-11T11:30:41Z")
The mapping you gave is for "last\_updated\_date" and the error message indicates that the field is "updated\_date".
---
### Author:  [@balumurari1](https://discuss.elastic.co/u/balumurari1)
#### Post date: [December 11, 2018, 3:14pm UTC](https://discuss.elastic.co/t/error-to-map-date-field-with-format-yyyy-mm-dd-hhss-sss/160341/7 "2018-12-11T15:14:15Z")
thanks for the reply,
i have applied the same for mapping field "updated\_date" and the result is the same
---
### Author:  [@admlko](https://discuss.elastic.co/u/admlko)
#### Post date: [December 11, 2018, 3:57pm UTC](https://discuss.elastic.co/t/error-to-map-date-field-with-format-yyyy-mm-dd-hhss-sss/160341/8 "2018-12-11T15:57:27Z")
And you recreated the index or reindexed the old data so the mapping gets applied?
Well, anyway the problem is the charater 'Z' at the end.
As it says:
> "reason"=\>"Invalid format: "2018-11-21T18:30:00.000Z" is malformed at "Z"
Why don't you post what does the rubydebug actually say about the event, maybe that will reveal what you are really trying to insert into the ES 🙂
---
### Author:  [@balumurari1](https://discuss.elastic.co/u/balumurari1)
#### Post date: [December 14, 2018, 9:49am UTC](https://discuss.elastic.co/t/error-to-map-date-field-with-format-yyyy-mm-dd-hhss-sss/160341/9 "2018-12-14T09:49:18Z")
the output is as follows,
Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"idx\_sqldata", :\_type=\>"\_doc", :\_routing=\>nil}, #LogStash::Event:0x613cc85f], :response=\>{"index"=\>{"\_index"=\>"idx\_sqldata", "\_type"=\>"\_doc", "\_id"=\>"bcDpnGcBu0SneeiwZGsB", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [updated\_date]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Invalid format: "2018-11-21T18:30:00.000Z" is malformed at "Z""}}}}}
---
### Author:  [@admlko](https://discuss.elastic.co/u/admlko)
#### Post date: [December 14, 2018, 10:05am UTC](https://discuss.elastic.co/t/error-to-map-date-field-with-format-yyyy-mm-dd-hhss-sss/160341/10 "2018-12-14T10:05:07Z")
Yes, I saw it already from your previous post.
But what I need to see is the event what you are trying to insert into Elasticsearch. You already have the config there in the output section, stdout with rubydebug.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 11, 2019, 10:05am UTC](https://discuss.elastic.co/t/error-to-map-date-field-with-format-yyyy-mm-dd-hhss-sss/160341/11 "2019-01-11T10:05:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.