# Invalid format (illegal\_argument\_exception)

**URL:** <https://discuss.elastic.co/t/invalid-format-illegal-argument-exception/112422>\
**Category:** Logstash\
**Created:** [December 19, 2017, 11:41am UTC](https://discuss.elastic.co/t/invalid-format-illegal-argument-exception/112422 "2017-12-19T11:41:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aman\_Verma1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aman_verma1/32/24656_2.png) [@Aman\_Verma1](https://discuss.elastic.co/u/Aman_Verma1)\
**Post date:** [December 19, 2017, 11:41am UTC](https://discuss.elastic.co/t/invalid-format-illegal-argument-exception/112422/1 "2017-12-19T11:41:40Z")

</div>

Can someone help me understand the underlying issue here. I am using kv filter to parse URL query parameters and pushing them to dynamically named indexes.

```
input {
  beats {
    port => 5045
  }
}

filter {
    grok { .. }
    kv {
        source => "apache2.access.url"
        field_split => "&?"
    }
}
output {
  elasticsearch {
    index => "httpd-%{[fields][app]}"
    ...
  }

```

Is "from" a reserved field, where's the format defined in this case ? Are there any illegal characters in the string ? Or am I missing the picture entirely ?

Any help would be appreciated.

> [2017-12-19T02:06:59,816][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"httpd-towerportal-2017.12.19", :\_type=\>"doc", :\_routing=\>nil}, #LogStash::Event:0x9323d8b], :response=\>{"index"=\>{"\_index"=\>"httpd-xxx-2017.12.19", "\_type"=\>"doc", "\_id"=\>"\*\*\*", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [from]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Invalid format: "/corporate-directory/""}}}}}

---

<div class="post-metadata">

**Author:** ![Aman\_Verma1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aman_verma1/32/24656_2.png) [@Aman\_Verma1](https://discuss.elastic.co/u/Aman_Verma1)\
**Post date:** [January 1, 2018, 3:10pm UTC](https://discuss.elastic.co/t/invalid-format-illegal-argument-exception/112422/2 "2018-01-01T15:10:40Z")

</div>

The underlying issue here was elasticsearch's automatic mapping identifying "from" as date because it was the case for few query parameters which were getting pushed before this one.

An index template specifying the type fixed the issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 29, 2018, 3:10pm UTC](https://discuss.elastic.co/t/invalid-format-illegal-argument-exception/112422/3 "2018-01-29T15:10:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.