# Logstash sending date instead of string **URL:** \ **Category:** Logstash\ **Created:** [March 7, 2018, 11:12am UTC](https://discuss.elastic.co/t/logstash-sending-date-instead-of-string/122866 "2018-03-07T11:12:22Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![jainbhavya53](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jainbhavya53](https://discuss.elastic.co/u/jainbhavya53)\ **Post date:** [March 7, 2018, 11:12am UTC](https://discuss.elastic.co/t/logstash-sending-date-instead-of-string/122866/1 "2018-03-07T11:12:22Z")
I am using grok filter to parse logs.In that there is a "time" field for which I am using "TIMESTAMP\_ISO8601" as the grok pattern. By default logstash should send this "time" field as "string" but it is sending it as date. I want that logstash should send this "time" field as string The "time" field has the following format:--2017-11-08T12:27:21.000Z Please help me with this. ---
**Author:** ![tag\_v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tag_v/32/47466_2.png) [@tag\_v](https://discuss.elastic.co/u/tag_v)\ **Post date:** [March 7, 2018, 12:03pm UTC](https://discuss.elastic.co/t/logstash-sending-date-instead-of-string/122866/2 "2018-03-07T12:03:46Z")
> [@jainbhavya53](#): > > want that logstash should send this "time" field as string use mutate convert for changing data type. > **[Mutate filter plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-convert)** Make sure you have index mapping for "time" field as text instead of date. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 7, 2018, 1:12pm UTC](https://discuss.elastic.co/t/logstash-sending-date-instead-of-string/122866/3 "2018-03-07T13:12:49Z")
It's not clear what you mean. When Logstash sends events to Elasticsearch (if that's what you're talking about) they're sent as JSON. There is no data type for timestamps in JSON so timestamps can only be represented as strings or numbers. Instead of describing the situation try giving a concrete example. ---
**Author:** ![jainbhavya53](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jainbhavya53](https://discuss.elastic.co/u/jainbhavya53)\ **Post date:** [March 7, 2018, 1:15pm UTC](https://discuss.elastic.co/t/logstash-sending-date-instead-of-string/122866/4 "2018-03-07T13:15:04Z")
I tried using mutate to convert "time" column into "string".but that did not work ---
**Author:** ![jainbhavya53](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jainbhavya53](https://discuss.elastic.co/u/jainbhavya53)\ **Post date:** [March 7, 2018, 2:12pm UTC](https://discuss.elastic.co/t/logstash-sending-date-instead-of-string/122866/5 "2018-03-07T14:12:11Z")
These are the contents of my conf file:-- ``` input { beats { port => LOGSTASH_PORT } } filter { grok { patterns_dir => "/home/application/bhavya/patterns/" match => { "message" => "\<%{USER:hField1}\>%{SPACE}%{IPV4:hIp1}%{SPACE}%{WORD:hHostName}%{SPACE}%{TIMESTAMP_ISO8601:time},%{IPV4:clientIp}"} } mutate { # Original message has been fully parsed, so remove it. #remove_field => ["message"] } ruby { code => "event.set('gsi_ts', event.get('@timestamp').to_i)" } } output { if "_grokparsefailure" in [tags] { elasticsearch { hosts => ["localhost:9200"] index => "error-bhavya-%{+yyyy.MM.dd}" document_type => "parsing_failure" } } else { elasticsearch { hosts => ["localhost:9200"] index => "bhavya-%{+yyyy.MM.dd}" document_type => "log" } } } ``` And my input logs are of the format:-- ``` <01910> xx.xx.xx.xx xyz 2017-11-08T12:27:21.000Z,xx.xx.xx.xx ``` GET bh\*/\_mapping Output in kibana:-- ![Screenshot%20from%202018-03-07%2019-37-40](https://us1.discourse-cdn.com/elastic/original/3X/4/7/47e1dbed470ad9265685015854bc0c8fc251b1e0.png) So instead of getting "type" for "time" field as "text" , I am getting "date" ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 7, 2018, 2:38pm UTC](https://discuss.elastic.co/t/logstash-sending-date-instead-of-string/122866/6 "2018-03-07T14:38:18Z")
That's because Elasticsearch autodetects the field as a date field based on what the string looks like. If you don't want that you can use an index template to force the `time` field to be a string. ---
**Author:** ![jainbhavya53](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jainbhavya53](https://discuss.elastic.co/u/jainbhavya53)\ **Post date:** [March 7, 2018, 7:30pm UTC](https://discuss.elastic.co/t/logstash-sending-date-instead-of-string/122866/7 "2018-03-07T19:30:59Z")
Does turning off dynamic mapping helpful in this case?? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 7, 2018, 8:18pm UTC](https://discuss.elastic.co/t/logstash-sending-date-instead-of-string/122866/8 "2018-03-07T20:18:50Z")
If you disable dynamic mapping you have to define _all_ fields upfront, before you index any documents. So yes, it solves your problem but it does a lot more too. ---
**Author:** ![jainbhavya53](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jainbhavya53](https://discuss.elastic.co/u/jainbhavya53)\ **Post date:** [March 8, 2018, 2:29am UTC](https://discuss.elastic.co/t/logstash-sending-date-instead-of-string/122866/9 "2018-03-08T02:29:11Z")
If logstash sends all the fields to elasticsearch as strings,then I think disabling dynamic mapping would work,wouldn't it?? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 8, 2018, 7:26am UTC](https://discuss.elastic.co/t/logstash-sending-date-instead-of-string/122866/10 "2018-03-08T07:26:42Z")
I don't think you quite understood what I wrote and I don't know how to explain it differently without just repeating myself. I suggest you try things out yourself and discover what works and what doesn't. ---
**Author:** ![vinodr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinodr/32/28759_2.png) [@vinodr](https://discuss.elastic.co/u/vinodr)\ **Post date:** [March 14, 2018, 3:31am UTC](https://discuss.elastic.co/t/logstash-sending-date-instead-of-string/122866/11 "2018-03-14T03:31:22Z")
@jainbhavya53 Modify the grok pattern and incorporate the mutate and date filter similar to below: ``` grok { patterns_dir => "/home/application/bhavya/patterns/" match => { "message" => "\<%{USER:hField1}\>%{SPACE}%{IPV4:hIp1}%{SPACE}%{WORD:hHostName}%{SPACE}%{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?,%{IPV4:clientIp}"} } mutate { add_field => {"time", "%{HOUR}:%{MINUTE}:%{SECOND}" } add_field => {"dttm", "%{YEAR}-%{MONTHNUM}-%{MONTHDAY}T%{HOUR}:%{MINUTE}:%{SECOND}.%{ISO8601_TIMEZONE}" } } date { match => ["dttm", "ISO8601"] } ``` This way you can retain 'time' as a string field and still have @timestamp replaced with the datetime value in the log. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 11, 2018, 3:31am UTC](https://discuss.elastic.co/t/logstash-sending-date-instead-of-string/122866/12 "2018-04-11T03:31:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.