# How to change data type for date field?

**URL:** <https://discuss.elastic.co/t/how-to-change-data-type-for-date-field/28843>\
**Category:** Logstash\
**Created:** [September 8, 2015, 2:25pm UTC](https://discuss.elastic.co/t/how-to-change-data-type-for-date-field/28843 "2015-09-08T14:25:01Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ish\_Sookun](https://avatars.discourse-cdn.com/v4/letter/i/bc79bd/32.png) [@Ish\_Sookun](https://discuss.elastic.co/u/Ish_Sookun)\
**Post date:** [September 8, 2015, 2:25pm UTC](https://discuss.elastic.co/t/how-to-change-data-type-for-date-field/28843/1 "2015-09-08T14:25:01Z")

</div>

Hello,

Is there anyone around who got a 'date' field as 'string'? Anyway to change the data type to 'date'? I need something like this:

{  
"data" : {  
"properties" : {  
"date": {  
"type" : "date",  
"format" : "yyyy-MM-dd HH:mm:ss"  
},  
"status": {"type" : "string"},  
"group": {"type" : "string"},  
"ip": {"type" : "string"},  
"username":{"type" : "string"},  
"category":{"type" : "string"},  
"url":{"type" : "string"}  
}  
}  
}

Unfortunately, my online searches did not help much. Below is an extract of the 'grok filter' I am using:

match =\> ["message", "%{TIMESTAMP\_ISO8601:logdate} %{DATA} %{WORD:status} %{USERNAME:group} %{DATA} %{IPV4:ip} %{DATA} %{USERNAME} %{SPACE} %{USERNAME:category} %{URI:url} %{WORD:method}"]

Most probably, the 'TIMESTAMP' data type isn't correct? Any advice please.

Regards,

Ish

---

<div class="post-metadata">

**Author:** ![Alex\_6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_6/32/1330_2.png) [@Alex\_6](https://discuss.elastic.co/u/Alex_6)\
**Post date:** [September 8, 2015, 3:11pm UTC](https://discuss.elastic.co/t/how-to-change-data-type-for-date-field/28843/2 "2015-09-08T15:11:49Z")

</div>

Use the [date filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html) after your Grok. So...

```
date {
	match => ["logdate", "ISO8601"]
	target => "logdate"
}

```

---

<div class="post-metadata">

**Author:** ![ashwin2011](https://avatars.discourse-cdn.com/v4/letter/a/c4cdca/32.png) [@ashwin2011](https://discuss.elastic.co/u/ashwin2011)\
**Post date:** [September 9, 2015, 6:00am UTC](https://discuss.elastic.co/t/how-to-change-data-type-for-date-field/28843/3 "2015-09-09T06:00:00Z")

</div>

Hi,

Below is the config :

filter {  
if [type] == "ufdb" {

```
            grok {
                    match => ["message", "%{TIMESTAMP_ISO8601:logdate} %{DATA} %{WORD:status} %{DATA} %{USERNAME:group} %{DATA} %{IPV4:ip} %{DATA} %{USERNAME} %{DATA} %{USERNAME:category} %{DATA} %{URI:url} %{WORD:method}"]

                    }

            grok {
                    match => ["message", "%{TIMESTAMP_ISO8601:logdate} %{DATA} %{WORD:status} %{USERNAME:group} %{DATA} %{IPV4:ip} %{DATA} %{USERNAME} %{SPACE} %{USERNAME:category} %{URI:url} %{WORD:method}"]
            }
            date {
      match => ["logdate", "ISO8601"]
      target => "logdate"
    }

```

}

below is the mapping that I get :

[http://192.168.1.10:9200/logstash-2015.09.09/ufdb/\_mapping](http://192.168.1.10:9200/logstash-2015.09.09/ufdb/_mapping)

```
    }
      },
      "ip": {
        "type": "string",
        "norms": {
          "enabled": false
        },
        "fields": {
          "raw": {
            "type": "string",
            "index": "not_analyzed",
            "ignore_above": 256
          }
        }
      },
      "logdate": {
        "type": "string", <------ "we need to set this type to date"
        "norms": {
          "enabled": false
        },
        "fields": {

```

The match don’t seem to work. Any ideas ?

---

<div class="post-metadata">

**Author:** ![Ish\_Sookun](https://avatars.discourse-cdn.com/v4/letter/i/bc79bd/32.png) [@Ish\_Sookun](https://discuss.elastic.co/u/Ish_Sookun)\
**Post date:** [September 9, 2015, 11:24am UTC](https://discuss.elastic.co/t/how-to-change-data-type-for-date-field/28843/4 "2015-09-09T11:24:22Z")

</div>

I changed the 'match' as follows and it worked:

```
date {
      match => ["logdate", "ISO8601", "YYYY-MM-dd HH:mm:ss"]
      target => "logdate"
      locale => "en"
    }

```

The format was actually wrong.

---

<div class="post-metadata">

**Author:** ![Vedran\_Maricevic](https://avatars.discourse-cdn.com/v4/letter/v/57b2e6/32.png) [@Vedran\_Maricevic](https://discuss.elastic.co/u/Vedran_Maricevic)\
**Post date:** [April 27, 2017, 3:54pm UTC](https://discuss.elastic.co/t/how-to-change-data-type-for-date-field/28843/5 "2017-04-27T15:54:50Z")

</div>

I have almost identical situation like you, but your solution did not solve my issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:26am UTC](https://discuss.elastic.co/t/how-to-change-data-type-for-date-field/28843/6 "2017-07-06T04:26:53Z")

</div>