# How to insert date type column of a csv file in the format "dd:MM:YYYY HH:mm:ss" into elasticsearch through logstash config

**URL:** https://discuss.elastic.co/t/how-to-insert-date-type-column-of-a-csv-file-in-the-format-ddyyyy-hhss-into-elasticsearch-through-logstash-config/268189
**Category:** Logstash
**Created:** [March 24, 2021, 9:51am UTC](https://discuss.elastic.co/t/how-to-insert-date-type-column-of-a-csv-file-in-the-format-ddyyyy-hhss-into-elasticsearch-through-logstash-config/268189 "2021-03-24T09:51:04Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![DEEPTHI\_SONA\_G](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/deepthi_sona_g/32/85930_2.png) [@DEEPTHI\_SONA\_G](https://discuss.elastic.co/u/DEEPTHI_SONA_G)
#### Post date: [March 24, 2021, 9:51am UTC](https://discuss.elastic.co/t/how-to-insert-date-type-column-of-a-csv-file-in-the-format-ddyyyy-hhss-into-elasticsearch-through-logstash-config/268189/1 "2021-03-24T09:51:04Z")

</div>

I'm trying to insert data from a csv file into elasticsearch using logstash. I have tried adding

```auto
  date {
                match => ["SIGHTING_TIME", "dd-MM-YYYY HH:mm:ss"]
                target =>"SIGHTING_TIME"
}

```

in the config file. But i find the mapping of the field "SIGHTING\_TIME" as text only . I want it to be changed to date format to perform some search queries on the date range. Any help would be appreciable.

---

<div class="post-metadata">

### Author: ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [March 24, 2021, 10:41am UTC](https://discuss.elastic.co/t/how-to-insert-date-type-column-of-a-csv-file-in-the-format-ddyyyy-hhss-into-elasticsearch-through-logstash-config/268189/2 "2021-03-24T10:41:48Z")

</div>

I'm guessing your index already had a mapping for `SIGHTING_TIME` that was generated as text the first time you ingested the data. Adding this to your Logstash config can't change the mapping.

If you want the mapping to be a date then you will need to change your mapping of that field to be a date in elasticsearch.

---

<div class="post-metadata">

### Author: ![DEEPTHI\_SONA\_G](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/deepthi_sona_g/32/85930_2.png) [@DEEPTHI\_SONA\_G](https://discuss.elastic.co/u/DEEPTHI_SONA_G)
#### Post date: [March 24, 2021, 11:24am UTC](https://discuss.elastic.co/t/how-to-insert-date-type-column-of-a-csv-file-in-the-format-ddyyyy-hhss-into-elasticsearch-through-logstash-config/268189/3 "2021-03-24T11:24:39Z")

</div>

May I know how can I change the mapping in elasticsearch? and also i have inserted the data into the index and is updating the mapping possible? May i have some clear idea on that.

---

<div class="post-metadata">

### Author: ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [March 24, 2021, 11:28am UTC](https://discuss.elastic.co/t/how-to-insert-date-type-column-of-a-csv-file-in-the-format-ddyyyy-hhss-into-elasticsearch-through-logstash-config/268189/4 "2021-03-24T11:28:57Z")

</div>

You can't really update it, in this case.

If your data is disposable then the easiest way is to delete your index. Create your [mapping](https://www.elastic.co/guide/en/elasticsearch/reference/current/explicit-mapping.html). Elastic will automap based on best guess if you ingest data without a mapping. You don't need to put all your fields in your mapping, just the ones that didn't automap correctly. Then re-ingest your data.

If you can't just delete your data then most people use the [reindex](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html) API to copy your data to a temporary index, change mapping on old, then reindex back to old index.

---

<div class="post-metadata">

### Author: ![DEEPTHI\_SONA\_G](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/deepthi_sona_g/32/85930_2.png) [@DEEPTHI\_SONA\_G](https://discuss.elastic.co/u/DEEPTHI_SONA_G)
#### Post date: [March 25, 2021, 11:30am UTC](https://discuss.elastic.co/t/how-to-insert-date-type-column-of-a-csv-file-in-the-format-ddyyyy-hhss-into-elasticsearch-through-logstash-config/268189/5 "2021-03-25T11:30:11Z")

</div>

I have tried creating mapping for a new index with the required date format in elasticsearch and then tried running the logstash config file to insert the csv data. Then i find the following warning and also found that no data was inserted into the index.

```auto
[WARN][logstash.outputs.elasticsearch][main][65f4fc0a575c13127baac0a4b09f8dc1296cfc01417be78f54c2154302f77b55] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"mtd_checkdate1", :routing=>nil, :_type=>"security_events"}, #<LogStash::Event:0xfbcc1a9>], :response=>{"index"=>{"_index"=>"mtd_checkdate1", "_type"=>"security_events", "_id"=>"HFsdaXgB2WWJNcKRoLkW", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [SIGHTING_TIME] cannot be changed from type [date] to [text]"}}}}

```

May i also know if iam proceeding in the correct way

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 22, 2021, 11:30am UTC](https://discuss.elastic.co/t/how-to-insert-date-type-column-of-a-csv-file-in-the-format-ddyyyy-hhss-into-elasticsearch-through-logstash-config/268189/6 "2021-04-22T11:30:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
