# Incorrect field type **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [July 25, 2018, 1:27pm UTC](https://discuss.elastic.co/t/incorrect-field-type/141585 "2018-07-25T13:27:40Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Nithani25](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nithani25/32/33457_2.png) [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Post date:** [July 25, 2018, 1:27pm UTC](https://discuss.elastic.co/t/incorrect-field-type/141585/1 "2018-07-25T13:27:40Z")
Hi Team, I am working something with (semi apache access log), copied below and i have also published my logstash conf file, i could see bytes,IP,date and respsonse code usually considerd as strings in kibana. I am able to resolve the problems with bytes and response by exclusively defining the mutate filter but the problems with IP and date persists. 0 10.00.00.208 - - [25/Jul/2018:00:00:08 -0700] "GET /Hollywood/movies/images/MT\_searchMagnifier.svg HTTP/1.1" 200 388 "[https://movies.ptin8.corp.prk.com/Hollywood/](https://movies.ptin8.corp.prk.com/Hollywood/)" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36" GET /Hollywood/movies/images/MT\_searchMagnifier.svg "-" "" "HTTP/1.1" prkolnx5124 "-" "-" 0 10.00.00.208 - - [25/Jul/2018:00:00:08 -0700] "GET /Hollywood/movies/images/MT\_Mylist\_normal.svg HTTP/1.1" 200 466 "[https://movies.ptin8.corp.prk.com/Hollywood/](https://movies.ptin8.corp.prk.com/Hollywood/)" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36" GET /Hollywood/movies/images/MT\_MySales\_normal.svg "-" "" "HTTP/1.1" prkolnx5124 "-" "-" 0 10.00.00.208 - - [25/Jul/2018:00:00:08 -0700] "GET /Hollywood/movies/images/MT\_Openmovies\_normal.svg HTTP/1.1" 200 442 "[https://movies.ptin8.corp.prk.com/Hollywood/](https://movies.ptin8.corp.prk.com/Hollywood/)" "Mozilla/5.0 (Windows NT 10.0; Win64; x 64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36" GET /Hollywood/movies/images/MT\_Openmovies\_normal.svg "-" "" "HTTP/1.1" prkolnx5124 "-" "-" 0 10.00.00.208 - - [25/Jul/2018:00:00:08 -0700] "GET /Hollywood/movies/images/MT\_Transactions\_normal.svg HTTP/1.1" 200 371 "[https://movies.ptin8.corp.prk.com/Hollywood/](https://movies.ptin8.corp.prk.com/Hollywood/)" "Mozilla/5.0 (Windows NT 10.0; Win64; x 64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36" GET /Hollywood/movies/images/MT\_Transactions\_normal.svg "-" "" "HTTP/1.1" prkolnx5124 "-" "-" 0 10.00.00.208 - - [25/Jul/2018:00:00:08 -0700] "GET /Hollywood/movies/images/MT\_Dasboard\_onClick.svg HTTP/1.1" 200 387 "[https://movies.ptin8.corp.prk.com/Hollywood/](https://movies.ptin8.corp.prk.com/Hollywood/)" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36" GET /Hollywood/movies/images/MT\_Dasboard\_onClick.svg "-" "" "HTTP/1.1" prkolnx5124 "-" "-" 0 10.00.00.208 - - [25/Jul/2018:00:00:08 -0700] "GET /Hollywood/movies/images/MT\_Dasboard\_myClients\_normal.svg HTTP/1.1" 200 663 "[https://movies.ptin8.corp.prk.com/Hollywood/](https://movies.ptin8.corp.prk.com/Hollywood/)" "Mozilla/5.0 (Windows NT 10.0; Wi n64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36" GET /Hollywood/movies/images/MT\_Dasboard\_myClients\_normal.svg "-" "" "HTTP/1.1" prkolnx5124 "-" "-" 0 10.00.00.208 - - [25/Jul/2018:00:00:09 -0700] "GET /Hollywood/movies/images/down\_Arrow\_Blue.svg HTTP/1.1" 200 239 "[https://movies.ptin8.corp.prk.com/Hollywood/](https://movies.ptin8.corp.prk.com/Hollywood/)" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36" GET /Hollywood/movies/images/down\_Arrow\_Blue.svg "-" "" "HTTP/1.1" prkolnx5124 "-" "-" ## My logstash conf file input { beats { port =\> "5041" } } filter { grok { match =\> { "message" =\> "%{CISCO\_REASON:ignor1} %{COMBINEDAPACHELOG} %{GREEDYDATA:ignore2}" } } mutate { convert =\> { "bytes" =\> "integer" } } mutate { convert =\> { "response" =\> "integer" } } mutate { strip =\> ["ignore1","ignore2"] } } ---
**Author:** ![Nithani25](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nithani25/32/33457_2.png) [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Post date:** [July 25, 2018, 1:28pm UTC](https://discuss.elastic.co/t/incorrect-field-type/141585/2 "2018-07-25T13:28:57Z")
Additional information, i have tried date filter many times but still getting date parser exception in the logs. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 25, 2018, 3:11pm UTC](https://discuss.elastic.co/t/incorrect-field-type/141585/3 "2018-07-25T15:11:03Z")
What does the date field look like if you use ``` output { stdout { codec => rubydebug } } ``` ---
**Author:** ![Nithani25](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nithani25/32/33457_2.png) [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Post date:** [July 26, 2018, 5:47am UTC](https://discuss.elastic.co/t/incorrect-field-type/141585/4 "2018-07-26T05:47:48Z")
My timestamp look like below. "timestamp" =\> "25/Jul/2018:00:00:08 -0700", ---
**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\ **Post date:** [July 26, 2018, 6:07am UTC](https://discuss.elastic.co/t/incorrect-field-type/141585/5 "2018-07-26T06:07:07Z")
How did you configure the date filter? Did you give it a pattern that looks like your date format string? It's a bit of a funky format, so you'll likely need to refer to the documentation. ---
**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\ **Post date:** [July 26, 2018, 6:10am UTC](https://discuss.elastic.co/t/incorrect-field-type/141585/6 "2018-07-26T06:10:14Z")
Worth noting: the type of a field in Elasticsearch cannot be changed. Once the field is created in an index, that index will attempt to coerce anything that it is given for that field into the field's type, so even if you get Logstash to output a different type, the type of the field in Elasticsearch will not change. ---
**Author:** ![Nithani25](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nithani25/32/33457_2.png) [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Post date:** [July 26, 2018, 6:14am UTC](https://discuss.elastic.co/t/incorrect-field-type/141585/7 "2018-07-26T06:14:07Z")
ok, i will share the date pattern shortly.. Meanwhile, i am facing a new problem here with my filebeat. I have taken a sample file containing exactly around 40 messages(format already mentioned in the earlier post)in them and started parsing it through filebeat, Although exclude filter and multiline pattern were set, i was expecting exactly 26 messages to be displayed in kibana,but i could only see 22 in them and missing the more important messages. ## Filebeat yml: - type: log ---
**Author:** ![Nithani25](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nithani25/32/33457_2.png) [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Post date:** [August 7, 2018, 7:32am UTC](https://discuss.elastic.co/t/incorrect-field-type/141585/8 "2018-08-07T07:32:55Z")
my date filter looks as below mutate { rename =\> { "timestamp" =\> "Apachetimestamp" } } date { match =\> ["Apachetimestamp" , "dd/MMM/yyyy:HH:mm:ss Z"] } ---
**Author:** ![Nithani25](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nithani25/32/33457_2.png) [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Post date:** [August 7, 2018, 7:34am UTC](https://discuss.elastic.co/t/incorrect-field-type/141585/9 "2018-08-07T07:34:16Z")
when i give the above date filter, i could see logstash creating indexes for every single timeline availables in the message, which is very strange ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 4, 2018, 7:34am UTC](https://discuss.elastic.co/t/incorrect-field-type/141585/10 "2018-09-04T07:34:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.