# ES 7.4 Field \[start\_time\] of type \[keyword\] does not support custom formats **URL:** \ **Category:** Elasticsearch\ **Created:** [July 16, 2020, 9:35pm UTC](https://discuss.elastic.co/t/es-7-4-field-start-time-of-type-keyword-does-not-support-custom-formats/241554 "2020-07-16T21:35:58Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![ghirsch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ghirsch/32/46074_2.png) [@ghirsch](https://discuss.elastic.co/u/ghirsch)\ **Post date:** [July 16, 2020, 9:35pm UTC](https://discuss.elastic.co/t/es-7-4-field-start-time-of-type-keyword-does-not-support-custom-formats/241554/1 "2020-07-16T21:35:59Z")
Hi, I have an elasticsearch index with dynamic field mapping. I am inserting a log into the index with a field `start_time` in the RFC3339 format (e.g. "2020-07-15T23:45:16Z") and until today this field was getting discovered as a date. However in the new index we created today, it was discovered as a keyword instead. We did just upgrade to ES 7.4, but it's not clear to me why that would have affected anything. Now when we try to run queries in Kibana, they fail and we see the error `Field [start_time] of type [keyword] does not support custom formats` Is there a good way to make sure this doesn't happen? I'm also not understanding the failure. I get that it could cause queries that use the field to give unexpected results, but I don't know why it would be "unsupported", or why it would cause queries that don't involve that field to fail. I'd really appreciate some advice, thank you! ---
**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Post date:** [July 16, 2020, 10:18pm UTC](https://discuss.elastic.co/t/es-7-4-field-start-time-of-type-keyword-does-not-support-custom-formats/241554/2 "2020-07-16T22:18:17Z")
Do you supply a template with mapping for this field? That is the only safe way to ensure the proper field type, probably strict\_date\_optional\_time. If there is no supplied mapping, Elasticsearch tries to dynamically determine the field type based on the first encountered field contents. For example a log with CSV style headers will usually map all field as keyword because it encounters the header text first. ---
**Author:** ![ghirsch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ghirsch/32/46074_2.png) [@ghirsch](https://discuss.elastic.co/u/ghirsch)\ **Post date:** [July 16, 2020, 11:10pm UTC](https://discuss.elastic.co/t/es-7-4-field-start-time-of-type-keyword-does-not-support-custom-formats/241554/3 "2020-07-16T23:10:26Z")
I see. We do supply a template, but it does not have this field in the mapping. Unfortunately we use that template for multiple indices, some of which don't need that field. But it sounds like I should either add the field to the template and just accept that some indices will get a useless field OR make two templates, one for each set of indices. It's also weird that we saw a change to the field type today since the data we were sending shouldn't have changed (and it's JSON, not CSV), but I guess for now it's not worth spending too much time on getting the dynamic stuff to work when we can just explicitly specify like you suggested. Thanks! ---
**Author:** ![Vinayak\_Sapre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinayak_sapre/32/45939_2.png) [@Vinayak\_Sapre](https://discuss.elastic.co/u/Vinayak_Sapre)\ **Post date:** [July 17, 2020, 1:11am UTC](https://discuss.elastic.co/t/es-7-4-field-start-time-of-type-keyword-does-not-support-custom-formats/241554/4 "2020-07-17T01:11:05Z")
@ghirsch > [@ghirsch](#): > > We did just upgrade to ES 7.4, but it's not clear to me why that would have affected anything. Which version did you upgrade from? You can define another template with stricter index\_pattern and define just this field in that. If both patterns match mappings and settings will be merged. If you want to redefine field you can use order property. See [Put index template API | Elasticsearch Guide [7.4] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.4/indices-templates.html) ---
**Author:** ![ghirsch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ghirsch/32/46074_2.png) [@ghirsch](https://discuss.elastic.co/u/ghirsch)\ **Post date:** [July 17, 2020, 1:42am UTC](https://discuss.elastic.co/t/es-7-4-field-start-time-of-type-keyword-does-not-support-custom-formats/241554/5 "2020-07-17T01:42:54Z")
From 6.3. And cool, I didn't realize that was a feature! I'll look into doing that sort of multiple-template setup. ---
**Author:** ![Vinayak\_Sapre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinayak_sapre/32/45939_2.png) [@Vinayak\_Sapre](https://discuss.elastic.co/u/Vinayak_Sapre)\ **Post date:** [July 17, 2020, 1:55am UTC](https://discuss.elastic.co/t/es-7-4-field-start-time-of-type-keyword-does-not-support-custom-formats/241554/6 "2020-07-17T01:55:10Z")
@ghirsch ES switched from Joda time to Java time in 7.0. [https://www.elastic.co/guide/en/elasticsearch/reference/7.x/migrate-to-java-time.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.x/migrate-to-java-time.html). Just FYI... Not saying it's a root cause of your issue. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 14, 2020, 1:55am UTC](https://discuss.elastic.co/t/es-7-4-field-start-time-of-type-keyword-does-not-support-custom-formats/241554/7 "2020-08-14T01:55:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.