# Failed to parse date field **URL:** \ **Category:** Logstash\ **Tags:** windows\ **Created:** [April 12, 2022, 2:44pm UTC](https://discuss.elastic.co/t/failed-to-parse-date-field/302248 "2022-04-12T14:44:25Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 12, 2022, 3:01pm UTC](https://discuss.elastic.co/t/failed-to-parse-date-field/302248/2 "2022-04-12T15:01:16Z")
> [@](#): > > "event\_data"=\>{"param1"=\>"Available", ... > > "reason"=\>"failed to parse field [winlog.event\_data.param1] of type [date] ... Preview of field's value: 'Available'", ... "reason"=\>"failed to parse date field [Available] with format [strict\_date\_optional\_time||epoch\_millis]" Most likely you have [dynamic mapping](https://www.elastic.co/guide/en/elasticsearch/reference/current/dynamic-field-mapping.html) enabled in elasticsearch. If the first document indexed has a value of [winlog][event\_data][param1] that looks like a date then elasticsearch will set the field type to date, and any document on which that field is not a valid date will get that mapping exception. That is true no matter whether the event comes from filebeat or logstash. It just depends what the first document indexed looks like. You need to add a [template](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-templates.html) or otherwise [set the mapping](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-put-mapping.html) on the index. Note that you cannot change the type of a field once created. You will need to create a new index. See [this](https://discuss.elastic.co/t/getting-illegal-state-exception-error-while-pushing-logs-to-elasticsearch/290029/2) post for more colour. --- _[View the full topic](https://discuss.elastic.co/t/failed-to-parse-date-field/302248)._