# How to send NULL DATE value to elasticsearch using logstash

**URL:** <https://discuss.elastic.co/t/how-to-send-null-date-value-to-elasticsearch-using-logstash/49560>\
**Category:** Logstash\
**Created:** [May 9, 2016, 2:31pm UTC](https://discuss.elastic.co/t/how-to-send-null-date-value-to-elasticsearch-using-logstash/49560 "2016-05-09T14:31:31Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![baneshbanna](https://avatars.discourse-cdn.com/v4/letter/b/5e9695/32.png) [@baneshbanna](https://discuss.elastic.co/u/baneshbanna)\
**Post date:** [May 9, 2016, 2:31pm UTC](https://discuss.elastic.co/t/how-to-send-null-date-value-to-elasticsearch-using-logstash/49560/1 "2016-05-09T14:31:31Z")

</div>

Hi,  
Its a blocker to me.  
I am not able to send NULL DATE value to the elasticsearch using logstash.  
null value storing as string in elasticsearch.  
if actual comes with proper date like 2012-01-01 11:11:11 it is also string as string even after converting to date using with the date filter.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 10, 2016, 7:22am UTC](https://discuss.elastic.co/t/how-to-send-null-date-value-to-elasticsearch-using-logstash/49560/2 "2016-05-10T07:22:41Z")

</div>

Are you using timebased indices?

---

<div class="post-metadata">

**Author:** ![baneshbanna](https://avatars.discourse-cdn.com/v4/letter/b/5e9695/32.png) [@baneshbanna](https://discuss.elastic.co/u/baneshbanna)\
**Post date:** [May 10, 2016, 7:48am UTC](https://discuss.elastic.co/t/how-to-send-null-date-value-to-elasticsearch-using-logstash/49560/3 "2016-05-10T07:48:48Z")

</div>

yes  
monthly indices,weekly indices

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 10, 2016, 9:46am UTC](https://discuss.elastic.co/t/how-to-send-null-date-value-to-elasticsearch-using-logstash/49560/4 "2016-05-10T09:46:32Z")

</div>

Then what is the value in sending a null timestamp? It'll just get put into the wrong index.

---

<div class="post-metadata">

**Author:** ![baneshbanna](https://avatars.discourse-cdn.com/v4/letter/b/5e9695/32.png) [@baneshbanna](https://discuss.elastic.co/u/baneshbanna)\
**Post date:** [May 10, 2016, 9:52am UTC](https://discuss.elastic.co/t/how-to-send-null-date-value-to-elasticsearch-using-logstash/49560/5 "2016-05-10T09:52:06Z")

</div>

I have one date field called datetime.  
it can have null values(null) and date values(2011-01-01 11:11:11.111).  
I am converting this date field to date using date filter like below

if[datetime]!='null' and [datetime]!='NULL'{  
date {  
match =\> ["datetime", "YYYY-MM-dd HH:mm:ss.SSS"]  
target =\>"datetime"  
timezone=\>"Asia/Kolkata"  
}  
}  
if it is null logstash storing as null string like 'null'.  
it should be store as null only.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 10, 2016, 9:53am UTC](https://discuss.elastic.co/t/how-to-send-null-date-value-to-elasticsearch-using-logstash/49560/6 "2016-05-10T09:53:55Z")

</div>

Except that will break in ES because it is not a valid timestamp.  
I don't think there is a good solution to your problem here.

---

<div class="post-metadata">

**Author:** ![baneshbanna](https://avatars.discourse-cdn.com/v4/letter/b/5e9695/32.png) [@baneshbanna](https://discuss.elastic.co/u/baneshbanna)\
**Post date:** [May 10, 2016, 9:55am UTC](https://discuss.elastic.co/t/how-to-send-null-date-value-to-elasticsearch-using-logstash/49560/7 "2016-05-10T09:55:17Z")

</div>

null date valid only .  
In RDBMS we can store null date also.why cant in ES

---

<div class="post-metadata">

**Author:** ![baneshbanna](https://avatars.discourse-cdn.com/v4/letter/b/5e9695/32.png) [@baneshbanna](https://discuss.elastic.co/u/baneshbanna)\
**Post date:** [May 10, 2016, 10:04am UTC](https://discuss.elastic.co/t/how-to-send-null-date-value-to-elasticsearch-using-logstash/49560/8 "2016-05-10T10:04:49Z")

</div>

Elasticsearch allows to store null dates using api  
URL:[http://localhost:9200/test\_index/test\_type/1](http://localhost:9200/test_index/test_type/1)  
BODY:{"ANSWEREDON":null}  
if we check mapping ANSWEREDON data type is date only.  
But from logstash not able to store null date.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:58am UTC](https://discuss.elastic.co/t/how-to-send-null-date-value-to-elasticsearch-using-logstash/49560/9 "2017-07-06T04:58:21Z")

</div>