# Illegal\_argument\_exception

**URL:** <https://discuss.elastic.co/t/illegal-argument-exception/311847>\
**Category:** SIEM\
**Created:** [August 10, 2022, 2:32pm UTC](https://discuss.elastic.co/t/illegal-argument-exception/311847 "2022-08-10T14:32:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Carlos\_Vinicius](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carlos_vinicius/32/95016_2.png) [@Carlos\_Vinicius](https://discuss.elastic.co/u/Carlos_Vinicius)\
**Post date:** [August 10, 2022, 2:32pm UTC](https://discuss.elastic.co/t/illegal-argument-exception/311847/1 "2022-08-10T14:32:55Z")

</div>

Dears, good morning!

I'm facing the error below, can someone shed some light on me?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/4/94e22e2013f01ad29085d6529fc199a28c815f3e.png)

{  
"took": 461,  
"timed\_out": false,  
"\_shards": {  
"total": 39,  
"successful": 38,  
"skipped": 33,  
"failed": 1,  
"failures": [  
{  
"shard": 0,  
"index": ".ds-filebeat-8.3.2-2022.08.09-000332",  
"node": "ozlh6n6QTyuVfQYC1on97A",  
"reason": {  
"type": "illegal\_argument\_exception",  
"reason": "error fetching [aws.cloudtrail.flattened.request\_parameters.TimePeriod.End]: Field [aws.cloudtrail.flattened.request\_parameters.TimePeriod.End] of type [flattened] doesn't support formats.",  
"caused\_by": {  
"type": "illegal\_argument\_exception",  
"reason": "Field [aws.cloudtrail.flattened.request\_parameters.TimePeriod.End] of type [flattened] doesn't support formats."  
}  
}  
}  
]  
},  
"hits": {  
"max\_score": null,  
"hits":   
}  
}

---

<div class="post-metadata">

**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\
**Post date:** [August 11, 2022, 12:27am UTC](https://discuss.elastic.co/t/illegal-argument-exception/311847/2 "2022-08-11T00:27:19Z")

</div>

Some field types support formatting their values in certain ways. For an example, date field can be formatted in different ways e.g. `epoch_millis` and `basic_date` etc. But most field types do not support formatting. In your case, the field `aws.cloudtrail.flattened.request_parameters.TimePeriod.End` is of type flattened and it does not support format. You need remove the `format` parameter from your search query.

---

<div class="post-metadata">

**Author:** ![Carlos\_Vinicius](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carlos_vinicius/32/95016_2.png) [@Carlos\_Vinicius](https://discuss.elastic.co/u/Carlos_Vinicius)\
**Post date:** [August 11, 2022, 11:59am UTC](https://discuss.elastic.co/t/illegal-argument-exception/311847/3 "2022-08-11T11:59:12Z")

</div>

Hi, thank you very much for your quick response, can you let me know how I make this change?

Sorry for my ignorance, I'm new to elastic

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 8, 2022, 11:59am UTC](https://discuss.elastic.co/t/illegal-argument-exception/311847/4 "2022-09-08T11:59:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.