# Insert epoch time as "date" field, without converting to ISO8601 format
**URL:** https://discuss.elastic.co/t/insert-epoch-time-as-date-field-without-converting-to-iso8601-format/309029
**Category:** Logstash
**Created:** [July 6, 2022, 3:36pm UTC](https://discuss.elastic.co/t/insert-epoch-time-as-date-field-without-converting-to-iso8601-format/309029 "2022-07-06T15:36:13Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Elie](https://discuss.elastic.co/u/Elie)
#### Post date: [July 6, 2022, 3:36pm UTC](https://discuss.elastic.co/t/insert-epoch-time-as-date-field-without-converting-to-iso8601-format/309029/1 "2022-07-06T15:36:13Z")
Hello,
I have an epoch time in the data that I am trying to parse via Logstash that I am trying to insert in a field in ES that represents the type "date". However, if i try to insert it just as it is, ES will assume the type of my epoch time to be a "long".
I have managed to fix the issue by changing the mapping of the field of the time in ES by inserting the following:
```auto
"time" : {
"type" : "date",
"format": "strict_date_optional_time||epoch_millis"
}
```
which solves my problem by letting me save epoch times with the type "date". However, I am not pleased by this as I would like to have it where Logstash automatically could make it so that the epoch time is recognized as a "date".
Here are a couple of methods that I have tried which have not worked:
The following simply changed my epoch time to the ISO8601, aka the readable format:
```auto
date {
match => ["[meta][time]", "UNIX_MS"]
target => "[meta][time]"
}
```
This inserted my epoch time as a "long" and not a "date":
```auto
ruby {
code => "
event.set('[meta][time]', event.get('[meta][time]').to_i)
"
}
```
Here I tried to create a temporary field (timeTemp) to hold the value of my epoch time, change the other field to a date with the date filter and copy the value from the temp field to my new date field, but again, this will just insert a long.
```auto
# Create the temp field
mutate {
add_field => { "[meta][timeTemp]" => "%{[meta][time]}" }
}
# Create the date field
date {
match => ["[meta][time]", "UNIX_MS"]
target => "[meta][time]"
}
# Copy the epoch time to the date field
mutate {
copy => { "[meta][timeTemp]" => "[meta][time]" }
}
# Delete the temp field
mutate {
remove_field => ["[meta][timeTemp]"]
}
```
I have also looked at the convert filter, but do not think that converting into a date is supported by Logstash as this gave me an error while running. Here is what I tried:
```auto
mutate {
convert => ["[meta][time]","date"]
}
```
I am now asking for some advice on how I should proceed with this. I basically want to be able to insert my epoch time (example: 1656925998200, this is epoch time in MS) into ES as the type "date", without converting it into any other formats and without having to manually have to create a mapping for it.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 6, 2022, 4:32pm UTC](https://discuss.elastic.co/t/insert-epoch-time-as-date-field-without-converting-to-iso8601-format/309029/2 "2022-07-06T16:32:09Z")
> [@Elie](#):
>
> I basically want to be able to insert my epoch time (example: 1656925998200, this is epoch time in MS) into ES as the type "date", without converting it into any other formats and without having to manually have to create a mapping for it.
convert supports conversions to integer, float, integer\_eu, float\_eu, string, and boolean. It cannot convert something to a date. That is what the date filter is for.
Your mutate/date/mutate/mutate appears to be a no-op. If saves the value of [meta][time], parses it, then overwrites it with the original value.
If there is no mapping defined, then dynamic mapping in elasticsearch will use [date detection](https://www.elastic.co/guide/en/elasticsearch/reference/current/dynamic-field-mapping.html#date-detection) to decide whether a field is a date. By default that makes anything that matches
```
["strict_date_optional_time","yyyy/MM/dd HH:mm:ss Z||yyyy/MM/dd Z"]
```
into a date field on the document. If a field in logstash is a date then it will be sent to elasticsearch in a format that matches strict\_date\_optional\_time (yyyy-MM-dd'T'HH:mm:ss.SSSZ), so elasticsearch will treat it as a date.
If you want the field to be a number in logstash, but a date in elasticsearch the only solution I can think of is to modify the dynamic\_date\_formats property of the index mapping to include epoch\_millis. However, that still involves creating a mapping and will probably have significant unintended consequences for other numeric fields.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 3, 2022, 4:32pm UTC](https://discuss.elastic.co/t/insert-epoch-time-as-date-field-without-converting-to-iso8601-format/309029/3 "2022-08-03T16:32:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.