# How to change all dates to a supported format

**URL:** <https://discuss.elastic.co/t/how-to-change-all-dates-to-a-supported-format/87381>\
**Category:** Logstash\
**Created:** [May 29, 2017, 12:21am UTC](https://discuss.elastic.co/t/how-to-change-all-dates-to-a-supported-format/87381 "2017-05-29T00:21:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ideal](https://avatars.discourse-cdn.com/v4/letter/i/e79b87/32.png) [@ideal](https://discuss.elastic.co/u/ideal)\
**Post date:** [May 29, 2017, 12:21am UTC](https://discuss.elastic.co/t/how-to-change-all-dates-to-a-supported-format/87381/1 "2017-05-29T00:21:28Z")

</div>

I'm sending JSON to logstash and it has about a dozen fields with dates in this format:  
yyyy-MM-dd HH:mm:ss

That date format generates an error because it is missing a "T" at the start of the time. The error logstash gives is:

[2017-05-28T10:47:34,167][WARN][logstash.outputs.elasticsearch] Failed action. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"myindex", :\_type=\>"mytype", :\_routing=\>nil}, 2017-05-28T14:47:33.630Z myhost.local %{message}], :response=\>{"index"=\>{"\_index"=\>"myindex", "\_type"=\>"mytype", "\_id"=\>"AVxPhs46KqpnKtvQdflL", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [[the.json.name](http://the.json.name)]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Invalid format: "2017-05-24 02:00:01" is malformed at " 02:00:01""}}}}}

How do I change all dates in the above format to yyyy-MM-dd'T'HH:mm:ss so that logstash will import them? These fields are not the timestamp field (that is another field and it is in a logstash-acceptable format). Since they are not the document timestamp, from what I understand, I don't use filter { date {...}}, but what do I use?

Thanks for the help.

---

<div class="post-metadata">

**Author:** ![thiago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago/32/32096_2.png) [@thiago](https://discuss.elastic.co/u/thiago)\
**Post date:** [May 29, 2017, 2:56am UTC](https://discuss.elastic.co/t/how-to-change-all-dates-to-a-supported-format/87381/2 "2017-05-29T02:56:19Z")

</div>

Hello,

You would need to apply the `date` filter for each field (you can set a different `target` field other then `@timestamp`).

Another option would be changing the mapping in Elasticsearch so it also supports this format (if you do this, keep in mind that your date format does not contains timezone, so Elasticsearch will use server's timezone)

Regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2017, 2:56am UTC](https://discuss.elastic.co/t/how-to-change-all-dates-to-a-supported-format/87381/3 "2017-06-26T02:56:47Z")

</div>

Closed on June 26, 2017, 2:56am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.