# Error with datetime field in Kibana

**URL:** <https://discuss.elastic.co/t/error-with-datetime-field-in-kibana/352759>\
**Category:** Logstash\
**Created:** [February 7, 2024, 12:58pm UTC](https://discuss.elastic.co/t/error-with-datetime-field-in-kibana/352759 "2024-02-07T12:58:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ehmontesinos](https://avatars.discourse-cdn.com/v4/letter/e/3d9bf3/32.png) [@ehmontesinos](https://discuss.elastic.co/u/ehmontesinos)\
**Post date:** [February 7, 2024, 12:58pm UTC](https://discuss.elastic.co/t/error-with-datetime-field-in-kibana/352759/1 "2024-02-07T12:58:15Z")

</div>

Hi to everyone

I have the following problem. I am exporting from a csv file to generate a dashboard with data that is read daily from that file, which is also generated daily. One of the fields that I include in the csv is the "last\_login\_date" field that I use to extract certain information and display it in a graph.

An example CSV file has the following information, separated by ","

```auto
user-id,date,last_login_date,assigned_quota,used_quota,number_files,number_shares,number_uploads,number_downloads
usernameXXXX,2024-02-07 10:05:21,2024-02-07 10:04:55,26843545600,23223408,151,2,3,531
usernameYYYY,2024-02-07 10:05:21,2024-02-07 10:04:55,26843545600,23223408,151,2,3,531

```

In the logstash I have the following configuration to process the data that comes from that csv file:

```auto
input {
     file {
         path => "/etc/logstash/conf.d/daily/*.csv"
         start_position => "beginning"
         sincedb_path => "/dev/null"
     }
}

filter {
     csv {
         skip_header => "true"
         separator => ","
         columns => [
             "user-id",
             "date",
             "last_login_date",
             "assigned_quota",
             "used_quota",
             "number_files",
             "number_shares",
             "number_uploads",
             "number_downloads"
         ]
         remove_field => ["message"]
     }
     date {
         match => ["date", "yyyy-MM-dd HH:mm:ss"]
         target => ["@timestamp"]
     }
     date {
         match => ["last_login_date", "yyyy-MM-dd HH:mm:ss"]
         target => ["last_login_date"]
     }
     mutate {convert => ["assigned_quota", "integer"]}
     mutate {convert => ["used_quota", "integer"]}
     mutate {convert => ["number_files", "integer"]}
     mutate {convert => ["number_shares", "integer"]}
     mutate {convert => ["number_uploads", "integer"]}
     mutate {convert => ["number_downloads", "integer"]}
}

output {
    elasticsearch {
         hosts => ["elk.mydomain.local:9200"]
         index => "nextcloud-usage-%{+YYYY.MM.dd}"
    }
    stdout { codec => rubydebug }
}

```

As you can see, the "last\_login\_field" field is formatted so that it takes the format that comes from the CSV.

In Kibana, when the file is processed, and I see the generated index, I see the following warning sign:

![imagen](https://us1.discourse-cdn.com/elastic/original/3X/3/e/3e18c2eb7e8bcafb8a205085a2fd3fc50d13424e.png)

I don't know how to solve it, can someone help me see where the problem is.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 7, 2024, 6:10pm UTC](https://discuss.elastic.co/t/error-with-datetime-field-in-kibana/352759/2 "2024-02-07T18:10:14Z")

</div>

Do you have pipeline.workers set to 1 as required? The [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-csv.html#plugins-filters-csv-skip_header) mentions this. I think in recent versions you will also need to set pipeline.ordered.

Otherwise, one pipeline may process a log entry and skip it as a header, then another pipeline may process a log entry and process last\_login\_date as a date, then a third pipeline may process a log entry and process "last\_login\_date" as a string. Check if any documents in your index have a \_dateparsefailure tag.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2024, 6:10pm UTC](https://discuss.elastic.co/t/error-with-datetime-field-in-kibana/352759/3 "2024-03-06T18:10:40Z")

</div>

Closed on March 6, 2024, 6:10pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.