# How to change the data type in Logstash **URL:** \ **Category:** Logstash\ **Created:** [July 9, 2015, 5:29pm UTC](https://discuss.elastic.co/t/how-to-change-the-data-type-in-logstash/25255 "2015-07-09T17:29:29Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Navneet\_Mathpal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/navneet_mathpal/32/3677_2.png) [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\ **Post date:** [July 9, 2015, 5:29pm UTC](https://discuss.elastic.co/t/how-to-change-the-data-type-in-logstash/25255/1 "2015-07-09T17:29:29Z")
Hi, I am indexing the CSV file using Logstash, default it index every field as string in elasticsearch. I want to change some field to Date type ,how can i do it in logstash ? ---
**Author:** ![JeremyinNC](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeremyinnc/32/44868_2.png) [@JeremyinNC](https://discuss.elastic.co/u/JeremyinNC)\ **Post date:** [July 9, 2015, 6:31pm UTC](https://discuss.elastic.co/t/how-to-change-the-data-type-in-logstash/25255/2 "2015-07-09T18:31:11Z")
Are you using grok to parse it? You can do something like %{NUMBER:uid:int} which will make the uid index as an integer. I think this only works for int & float. From [the grok page](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 9, 2015, 7:34pm UTC](https://discuss.elastic.co/t/how-to-change-the-data-type-in-logstash/25255/3 "2015-07-09T19:34:43Z")
You can use the mutate filter to change the data type of fields, but it doesn't support date conversions. However, I think ES automatically detects strings containing timestamps (at least some formats, like ISO8601) and dynamically maps the field as a date. You may have to use an index template to indicate which fields should be treated as dates, though. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 10, 2015, 3:58am UTC](https://discuss.elastic.co/t/how-to-change-the-data-type-in-logstash/25255/4 "2015-07-10T03:58:49Z")
ES does detect some timestamps, see [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html) for more info. ---
**Author:** ![Navneet\_Mathpal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/navneet_mathpal/32/3677_2.png) [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\ **Post date:** [July 10, 2015, 7:20am UTC](https://discuss.elastic.co/t/how-to-change-the-data-type-in-logstash/25255/5 "2015-07-10T07:20:55Z")
@JeremyinNC @magnusbaeck @warkolm I have a colum name called DEPLOY\_TIME ( like : 28-01-2015 19:33:44) , when it is indexing it into the ES it is mapping the type as string "DEPLOY\_TIME": { "norms": { "enabled": false }, "type": "string", "fields": { "raw": { "ignore\_above": 256, "index": "not\_analyzed", "type": "string" I have also tried the date filter like ``` csv { columns => ["colum1", "colum2", "colum3", "DEPLOY_TIME"] separator => ";"} date { type => "mycsv" match => ["DEPLOY_TIME", "DD-MM-YYYY HH:mm:ss"] } } ``` But it is still mapping DEPLOY\_TIME as String .. Any idea why and how can we resolve it ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 10, 2015, 7:29am UTC](https://discuss.elastic.co/t/how-to-change-the-data-type-in-logstash/25255/6 "2015-07-10T07:29:36Z")
You'll probably have to use an explicit mapping (preferably set via an index template) that defines the `DEPLOY_TIME` field as having the date type (like how Logstash sets up the `@timestamp` field). ---
**Author:** ![Navneet\_Mathpal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/navneet_mathpal/32/3677_2.png) [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\ **Post date:** [July 10, 2015, 7:51am UTC](https://discuss.elastic.co/t/how-to-change-the-data-type-in-logstash/25255/7 "2015-07-10T07:51:28Z")
> [@magnusbaeck](#): > > index menas first I need to create a index define mapping then push the data using logstash or default mapping for every index ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 10, 2015, 7:55am UTC](https://discuss.elastic.co/t/how-to-change-the-data-type-in-logstash/25255/8 "2015-07-10T07:55:21Z")
I don't quite get what you're asking, but I suggest you update the index template used for Logstash indexes by adding an entry for the `DEPLOY_TIME` field. Then the next Logstash index that gets created has a `DEPLOY_TIME` field with the correct type. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:35am UTC](https://discuss.elastic.co/t/how-to-change-the-data-type-in-logstash/25255/9 "2017-07-06T05:35:03Z")