# Mismatch in field type **URL:** \ **Category:** Logstash\ **Created:** [July 16, 2018, 5:34pm UTC](https://discuss.elastic.co/t/mismatch-in-field-type/140199 "2018-07-16T17:34:53Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Nithani25](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nithani25/32/33457_2.png) [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Post date:** [July 16, 2018, 5:34pm UTC](https://discuss.elastic.co/t/mismatch-in-field-type/140199/1 "2018-07-16T17:34:53Z")
Hi Team, I am new to ELK stack and i have completed setting up all ELKStack components such as filebeat ,logstash, Elastic and kibana on a single server and was successful in all my trails attempts, however when trying to feed apache access logs through simple grok pattern COMBINAPACHE, the field type of response and bytes are shown as "string" in kibana, i have tried changing it through mapping api, but unable to do so. Any quick help here can be of great value. Thanks ## Actual log format: 0 64.242.88.10 - - [07/Mar/2004:16:05:49 -0800] "GET /twiki/bin/edit/Main/Double\_bounce\_sender?topicparent=Main.ConfigurationVariables HTTP/1.1" 401 12846 "referrerstring" "browserinfo" "repeat of som junk details" ## My grok pattern: grok { match =\> { "message" =\> "%{CISCO\_REASON:ignore1} %{COMBINEDAPACHELOG} %{GREEDYDATA:ignore2}" } ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 16, 2018, 5:54pm UTC](https://discuss.elastic.co/t/mismatch-in-field-type/140199/2 "2018-07-16T17:54:41Z")
COMBINEDAPACHELOG does seem to parse bytes as a string. You could use a [mutate+convert](https://www.elastic.co/guide/en/logstash/6.2/plugins-filters-mutate.html#plugins-filters-mutate-convert) filter to make it an integer. However, that may get a mapping conflict until the daily log rolls over. ---
**Author:** ![Nithani25](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nithani25/32/33457_2.png) [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Post date:** [July 17, 2018, 10:22am UTC](https://discuss.elastic.co/t/mismatch-in-field-type/140199/3 "2018-07-17T10:22:04Z")
Hi, Thanks i am able to convert the response and byte information into numbers through mutate file, however the timestamp field in the log is still considered as string and mutate doesn't allow us to convert the timestamp into date field. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 17, 2018, 12:36pm UTC](https://discuss.elastic.co/t/mismatch-in-field-type/140199/4 "2018-07-17T12:36:05Z")
You would use a [date](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html) filter for that. ---
**Author:** ![Nithani25](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nithani25/32/33457_2.png) [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Post date:** [July 18, 2018, 8:29am UTC](https://discuss.elastic.co/t/mismatch-in-field-type/140199/5 "2018-07-18T08:29:31Z")
Thanks !!!, But i have very strange issue now which is not letting me create indexes. the moment i start my elastic service, its showing a very strange message like recovering indexes and the below message and it starts creating unwanted index for every single day in the month(2 months) * * * 2018-07-16T23:01:50,456][INFO][o.e.c.m.MetaDataCreateIndexService] [Demonstrate] [logstash-2018.06.20] creating index, cause [auto(bulk api)], templates [logstash], shards [5]/[1], mappings [_defult_] [2018-07-16T23:01:50,545][INFO][o.e.c.m.MetaDataMappingService] [Demonstrate] [logstash-2018.06.20/48EadkjOR0iGTHTIvk9LLw] create\_mapping [doc] * * * I did go through some man pages and tried deleting those index and but the problem seems to persist. Can you help me on this too... ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 18, 2018, 2:52pm UTC](https://discuss.elastic.co/t/mismatch-in-field-type/140199/6 "2018-07-18T14:52:48Z")
I am not sure I understood that, but if you use a date filter to set the @timestamp field, then using the defaults, an elasticsearch output will create indexes which match the @timestamp field. So if you index data from the last couple of months then you will get indexes for every day from the last couple of months. ---
**Author:** ![Nithani25](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nithani25/32/33457_2.png) [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Post date:** [July 22, 2018, 10:39am UTC](https://discuss.elastic.co/t/mismatch-in-field-type/140199/7 "2018-07-22T10:39:21Z")
Alright !!, but i could still see my timestmap and clientip field listed as strings in kibana.. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 19, 2018, 10:39am UTC](https://discuss.elastic.co/t/mismatch-in-field-type/140199/8 "2018-08-19T10:39:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.