# Help parsing a date field

**URL:** <https://discuss.elastic.co/t/help-parsing-a-date-field/240253>\
**Category:** Elasticsearch\
**Created:** [July 8, 2020, 3:12am UTC](https://discuss.elastic.co/t/help-parsing-a-date-field/240253 "2020-07-08T03:12:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ajhstn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ajhstn/32/24629_2.png) [@ajhstn](https://discuss.elastic.co/u/ajhstn)\
**Post date:** [July 8, 2020, 3:12am UTC](https://discuss.elastic.co/t/help-parsing-a-date-field/240253/1 "2020-07-08T03:12:58Z")

</div>

Hello, my source data has the following dates, which i am struggling to create the correct field mapping.

`"notBefore": "Jun 9 00:31:02 2020 GMT", "notAfter": "Jun 9 00:31:02 2025 GMT"`

i have tried various combinations, but basically looking like this, and i just can't get it right.

```auto
"notBefore": {
            "type": "date",
            "format": "MMM dd hh:mm:ss yyyy ZZZ",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          }

```

The errors are obvious

```auto
{"index":{"_index":"sslscan-2020","_type":"_doc","_id":"UHlkLHMBb4m0aeo6mAc9","status":400,"error":{"type":"mapper_parsing_exception","reason":"failed to parse field [certificateChain.notBefore] of type [date] in document with id 'UHlkLHMBb4m0aeo6mAc9'. Preview of field's value: 'Dec 8 00:00:00 2018 GMT'","caused_by":{"type":"illegal_argument_exception","reason":"failed to parse date field [Dec 8 00:00:00 2018 GMT] with format [strict_date_optional_time||epoch_millis]","caused_by":{"type":"date_time_parse_exception","reason":"Failed to parse with all enclosed parsers"}}}}}

```

---

<div class="post-metadata">

**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\
**Post date:** [July 8, 2020, 6:56am UTC](https://discuss.elastic.co/t/help-parsing-a-date-field/240253/2 "2020-07-08T06:56:31Z")

</div>

according to the [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html#custom-date-formats) custom date format is supported

I would try something like

```auto
MMM d HH:mm:ss uuuu z

```

**Did not test**

---

<div class="post-metadata">

**Author:** ![ajhstn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ajhstn/32/24629_2.png) [@ajhstn](https://discuss.elastic.co/u/ajhstn)\
**Post date:** [July 8, 2020, 10:22pm UTC](https://discuss.elastic.co/t/help-parsing-a-date-field/240253/3 "2020-07-08T22:22:24Z")

</div>

Hi @AClerk - thank you for the reply. Unfortunately, I tried this and still get parsing errors. I think i will solve this another way and shape the date correctly prior to sending it to ES.

---

<div class="post-metadata">

**Author:** ![ajhstn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ajhstn/32/24629_2.png) [@ajhstn](https://discuss.elastic.co/u/ajhstn)\
**Post date:** [July 9, 2020, 1:24am UTC](https://discuss.elastic.co/t/help-parsing-a-date-field/240253/4 "2020-07-09T01:24:34Z")

</div>

I have now instead used [https://github.com/PaulSec/crt.sh](https://github.com/PaulSec/crt.sh) to pull certificates straight from CTL, and POST them to ES using the python bulk helper, ref ([https://kb.objectrocket.com/elasticsearch/how-to-use-python-helpers-to-bulk-load-data-into-an-elasticsearch-index](https://kb.objectrocket.com/elasticsearch/how-to-use-python-helpers-to-bulk-load-data-into-an-elasticsearch-index))

Works like a dream.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 6, 2020, 1:24am UTC](https://discuss.elastic.co/t/help-parsing-a-date-field/240253/5 "2020-08-06T01:24:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.