# Field Type changing between indexes breaking searches

**URL:** <https://discuss.elastic.co/t/field-type-changing-between-indexes-breaking-searches/45509>\
**Category:** Elasticsearch\
**Created:** [March 26, 2016, 10:12am UTC](https://discuss.elastic.co/t/field-type-changing-between-indexes-breaking-searches/45509 "2016-03-26T10:12:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![romeotheriault](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/romeotheriault/32/8704_2.png) [@romeotheriault](https://discuss.elastic.co/u/romeotheriault)\
**Post date:** [March 26, 2016, 10:12am UTC](https://discuss.elastic.co/t/field-type-changing-between-indexes-breaking-searches/45509/1 "2016-03-26T10:12:25Z")

</div>

I send windows eventlogs and linux syslog messages to logstash which then sends them into elasticsearch. Most of the time everything works great, but once in a while it seems some messages get sent in that mess up searching in elasticsearch. When this happens a search returns shard failures with this error:

Field data loading is forbidden on StartTime

I checked the "type" of StartTime on all of the indexes and most have it set (properly) to:

```
                "StartTime": {
                    "format": "strict_date_optional_time||epoch_millis",
                    "type": "date"

```

but some have the field with a type of "string". Which is what appears to be breaking the searches.

How can I fix this? How can I force StartTime to be of type date? How can I find what messages have the StartTime field with the "string"?

Thank you!

---

<div class="post-metadata">

**Author:** ![Glen\_Smith](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/glen_smith/32/111656_2.png) [@Glen\_Smith](https://discuss.elastic.co/u/Glen_Smith)\
**Post date:** [March 26, 2016, 2:23pm UTC](https://discuss.elastic.co/t/field-type-changing-between-indexes-breaking-searches/45509/2 "2016-03-26T14:23:24Z")

</div>

Look into Index Templates - what they are in Elasticsearch and how Logstash can be configured to use them.

You quite likely have one for logstash in place on your cluster. Updating that to map StartTime as a date with the formats you expect will cause that to happen upon every index creation that matches the template name pattern.

---

<div class="post-metadata">

**Author:** ![romeotheriault](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/romeotheriault/32/8704_2.png) [@romeotheriault](https://discuss.elastic.co/u/romeotheriault)\
**Post date:** [March 28, 2016, 2:14am UTC](https://discuss.elastic.co/t/field-type-changing-between-indexes-breaking-searches/45509/3 "2016-03-28T02:14:08Z")

</div>

Thanks for the pointer Glen! I'll look into that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:04pm UTC](https://discuss.elastic.co/t/field-type-changing-between-indexes-breaking-searches/45509/4 "2017-07-05T23:04:50Z")

</div>