# Failed to parse date field, date\_time\_parse\_exception

**URL:** <https://discuss.elastic.co/t/failed-to-parse-date-field-date-time-parse-exception/261492>\
**Category:** Elasticsearch\
**Created:** [January 19, 2021, 4:30am UTC](https://discuss.elastic.co/t/failed-to-parse-date-field-date-time-parse-exception/261492 "2021-01-19T04:30:56Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![yulaika](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yulaika/32/77403_2.png) [@yulaika](https://discuss.elastic.co/u/yulaika)\
**Post date:** [January 19, 2021, 4:30am UTC](https://discuss.elastic.co/t/failed-to-parse-date-field-date-time-parse-exception/261492/1 "2021-01-19T04:30:56Z")

</div>

Here is my configuration:  
"[log][timestamp]" =\> "%{[yearinlog]}-%{[monthinlog]}-%{[dateinlog]} %{[hourinlog]}:%{[minuteinlog]}:%{[secondinlog]}"  
}  
}  
date {  
match =\> [  
"[log][timestamp]",  
"yyyy-MM-dd HH:mm:ss.SSS000"  
]  
timezone =\> "Asia/Singapore"  
target =\> "@timestamp"  
}

I am trying to parse into elastic search but i am getting these as shown below. Any ideas how I can fix this?

Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"filebeat-mneta-app-2021.01.14", :\_type=\>"\_doc", :routing=\>nil}, #LogStash::Event:0x3091220c], :response=\>{"index"=\>{"\_index"=\>"filebeat-mneta-app-2021.01.14", "\_type"=\>"\_doc", "\_id"=\>"dEfHGHcBobdQVkyHZgd2", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field [log.timestamp] of type [date] in document with id 'dEfHGHcBobdQVkyHZgd2'. Preview of field's value: '2021-01-15 03:32:11.874'", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"failed to parse date field [2021-01-15 03:32:11.874] with format [strict\_date\_optional\_time||epoch\_millis]", "caused\_by"=\>{"type"=\>"date\_time\_parse\_exception", "reason"=\>"Failed to parse with all enclosed parsers"}}}}}}

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 19, 2021, 4:36am UTC](https://discuss.elastic.co/t/failed-to-parse-date-field-date-time-parse-exception/261492/2 "2021-01-19T04:36:42Z")

</div>

You can see the format of `strict_date_optional_time` here - [https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html)

What is the mapping of the `log.timestamp` field?

---

<div class="post-metadata">

**Author:** ![yulaika](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yulaika/32/77403_2.png) [@yulaika](https://discuss.elastic.co/u/yulaika)\
**Post date:** [January 19, 2021, 7:04am UTC](https://discuss.elastic.co/t/failed-to-parse-date-field-date-time-parse-exception/261492/3 "2021-01-19T07:04:08Z")

</div>

2014-05-12 17:10:06.209000

here? im not sure what can i do to resolve this

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 19, 2021, 9:07am UTC](https://discuss.elastic.co/t/failed-to-parse-date-field-date-time-parse-exception/261492/4 "2021-01-19T09:07:59Z")

</div>

That is not the mapping though.

---

<div class="post-metadata">

**Author:** ![yulaika](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yulaika/32/77403_2.png) [@yulaika](https://discuss.elastic.co/u/yulaika)\
**Post date:** [January 19, 2021, 11:36am UTC](https://discuss.elastic.co/t/failed-to-parse-date-field-date-time-parse-exception/261492/5 "2021-01-19T11:36:20Z")

</div>

what is considered as mapping though? sorry

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 19, 2021, 11:04pm UTC](https://discuss.elastic.co/t/failed-to-parse-date-field-date-time-parse-exception/261492/6 "2021-01-19T23:04:16Z")

</div>

`GET filebeat-mneta-app-2021.01.14/_mapping` in tghe Kibana console will show it.

---

<div class="post-metadata">

**Author:** ![yulaika](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yulaika/32/77403_2.png) [@yulaika](https://discuss.elastic.co/u/yulaika)\
**Post date:** [January 20, 2021, 1:02am UTC](https://discuss.elastic.co/t/failed-to-parse-date-field-date-time-parse-exception/261492/7 "2021-01-20T01:02:59Z")

</div>

oh thanks. here is my mapping

{"filebeat-mneta-app-2021.01.14":{"mappings":{"properties":{"@timestamp":{"type":"date"},"@version":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"agent":{"properties":{"ephemeral\_id":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"hostname":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"id":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"type":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"version":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}}}},"dateinpath":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"ecs":{"properties":{"version":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}}}},"event":{"properties":{"app":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"created":{"type":"date"},"dataset":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}}}},"host":{"properties":{"name":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}}}},"impact":{"type":"text","fields":{"keyword":{"type":"keyword"}}},"input":{"properties":{"type":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}}}},"log":{"properties":{"file":{"properties":{"path":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}}}},"offset":{"type":"long"},"timestamp":{"type":"date"}}},"log\_level":{"type":"text","fields":{"keyword":{"type":"keyword"}}},"log\_message":{"type":"text","fields":{"keyword":{"type":"keyword"}}},"monthinpath":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"scenario":{"type":"keyword","fields":{"keyword":{"type":"keyword"}}},"tags":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}},"yearinpath":{"type":"text","fields":{"keyword":{"type":"keyword","ignore\_above":256}}}}}}}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 17, 2021, 1:03am UTC](https://discuss.elastic.co/t/failed-to-parse-date-field-date-time-parse-exception/261492/8 "2021-02-17T01:03:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.