# Help with index template format for date with 6 millis

**URL:** <https://discuss.elastic.co/t/help-with-index-template-format-for-date-with-6-millis/149450>\
**Category:** Elasticsearch\
**Created:** [September 21, 2018, 12:41pm UTC](https://discuss.elastic.co/t/help-with-index-template-format-for-date-with-6-millis/149450 "2018-09-21T12:41:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![reswob](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/reswob/32/38015_2.png) [@reswob](https://discuss.elastic.co/u/reswob)\
**Post date:** [September 21, 2018, 12:41pm UTC](https://discuss.elastic.co/t/help-with-index-template-format-for-date-with-6-millis/149450/1 "2018-09-21T12:41:11Z")

</div>

I have a time field that has dates like: 2018-09-21T08:10:22.441223-0400 and I tried to create my template with the following:

"format" : "YYYY-MM-dd'T'HH:mm:ss.SSSSSS-Z"  
"format" : "YYYY-MM-ddTHH:mm:ss.SSSSSS-Z"  
"format" : "YYYY-MM-dd'T'HH:mm:ss.SSSSSSZ"

All these fail with the reason of "failed to parse" caused by "illegal\_argument\_exception" reason "Invalid format: "2018-09-21T08:10:22.441223-0400" is malformed at "T08:10:22.441223-0400"

Suggestions?

EDIT:

Some additional info: Maybe I'm missing something, but the timestamp is in the same format and for that I'm simply using the logstash config of:

date {  
match =\> ["datefield" , "ISO8601"]  
}

is there a template equivalent? I have not been able to find at [http://www.joda.org/joda-time/key\_format.html](http://www.joda.org/joda-time/key_format.html) or at [http://www.joda.org/joda-time/apidocs/org/joda/time/format/ISODateTimeFormat.html](http://www.joda.org/joda-time/apidocs/org/joda/time/format/ISODateTimeFormat.html)

---

<div class="post-metadata">

**Author:** ![jakelandis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jakelandis/32/36163_2.png) [@jakelandis](https://discuss.elastic.co/u/jakelandis)\
**Post date:** [September 21, 2018, 4:53pm UTC](https://discuss.elastic.co/t/help-with-index-template-format-for-date-with-6-millis/149450/2 "2018-09-21T16:53:55Z")

</div>

I think your pattern needs to use a lowercase `y` for the year. The following should work: `yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ`.

Curious to why need to specify the pattern at all ? Is the default loosing some of the millisecond precision ?

---

<div class="post-metadata">

**Author:** ![reswob](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/reswob/32/38015_2.png) [@reswob](https://discuss.elastic.co/u/reswob)\
**Post date:** [September 21, 2018, 5:21pm UTC](https://discuss.elastic.co/t/help-with-index-template-format-for-date-with-6-millis/149450/3 "2018-09-21T17:21:41Z")

</div>

None of the millisecond patterns showed a millisecond pattern to six characters...

[https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html)

I am going to try the lower case...

---

<div class="post-metadata">

**Author:** ![reswob](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/reswob/32/38015_2.png) [@reswob](https://discuss.elastic.co/u/reswob)\
**Post date:** [September 21, 2018, 5:41pm UTC](https://discuss.elastic.co/t/help-with-index-template-format-for-date-with-6-millis/149450/4 "2018-09-21T17:41:36Z")

</div>

OK, I was dumping logs into a test index and had set the template to not define that field. I just went to make that change and I noticed that ES analyzed that field and decided it was a date.

On the other hand, your suggestion worked! Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 19, 2018, 5:41pm UTC](https://discuss.elastic.co/t/help-with-index-template-format-for-date-with-6-millis/149450/5 "2018-10-19T17:41:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
