# Not able to send multiple date fields in logstash

**URL:** <https://discuss.elastic.co/t/not-able-to-send-multiple-date-fields-in-logstash/83359>\
**Category:** Logstash\
**Created:** [April 24, 2017, 6:22am UTC](https://discuss.elastic.co/t/not-able-to-send-multiple-date-fields-in-logstash/83359 "2017-04-24T06:22:49Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![SanC](https://avatars.discourse-cdn.com/v4/letter/s/9de053/32.png) [@SanC](https://discuss.elastic.co/u/SanC)\
**Post date:** [April 24, 2017, 6:22am UTC](https://discuss.elastic.co/t/not-able-to-send-multiple-date-fields-in-logstash/83359/1 "2017-04-24T06:22:49Z")

</div>

My Log file-  
MachineName|FeedName|Version|InputFileName|LoadType|StartTime|NumOfRecordsinCEMP|NumOfRecordsinStage|Status|Message|EndTime|EventSeverity|Action|time\_taken\_ms  
EDTD-LYNXSQL01|Falcon|2017-04-13\_180858\_7480000|2017-04-13\_180858\_7482003\_urn\_uuid\_67d977da-25c4-4e31-9f84-8a37562662e5.xml|Delta|2017-04-21 10:02:01.827|0|4|Success|File Loaded into DB|2017-04-21 10:37:49.000|Info|I|2147173  
EDTD-LYNXSQL01|Falcon|2017-04-13\_180916\_0290000|2017-04-13\_180916\_0299310\_urn\_uuid\_1d9a9239-fba8-497c-8023-6fe1eec70aaa.xml|Delta|2017-04-21 10:02:03.470|0|1|Success|File Loaded into DB|2017-04-21 10:37:49.000|Info|I|2145530MachineName|FeedName|Version|InputFileName|LoadType|StartTime|NumOfRecordsinCEMP|NumOfRecordsinStage|Status|Message|EndTime|EventSeverity|Action|time\_taken\_ms  
EDTD-LYNXSQL01|Falcon|2017-04-13\_180858\_7480000|2017-04-13\_180858\_7482003\_urn\_uuid\_67d977da-25c4-4e31-9f84-8a37562662e5.xml|Delta|2017-04-21 10:02:01.827|0|4|Success|File Loaded into DB|2017-04-21 10:37:49.000|Info|I|2147173  
EDTD-LYNXSQL01|Falcon|2017-04-13\_180916\_0290000|2017-04-13\_180916\_0299310\_urn\_uuid\_1d9a9239-fba8-497c-8023-6fe1eec70aaa.xml|Delta|2017-04-21 10:02:03.470|0|1|Success|File Loaded into DB|2017-04-21 10:37:49.000|Info|I|2145530

My logstash config file is-  
filter {  
if [type] == "RDS\_Logs"{

if [message] =~ /^"MachineName|FeedName|Version"/ {  
drop { }  
}  
csv {  
separator =\> "|"  
#MachineName|FeedName|Version|InputFileName|LoadType|StartTime|NumOfRecordsinCEMP|NumOfRecordsinStage|Status|Message|EndTime|EventSeverity|Action|time\_taken\_ms  
columns =\> ["MachineName","FeedName","Version","InputFileName","LoadType","StartTime","NumOfRecordsinCEMP","NumOfRecordsinStage","Status","sp-message","EndTime","EventSeverity","Action","time\_taken\_ms"]  
}

```
date {
	match => ["StartTime","YYYY-MM-dd;HH:mm:ss.SSS","ISO8601"]
	timezone => "Europe/London"
	target => "StartTime"
	locale=>"en"	

 }
date {
	match => ["EndTime", "YYYY-MM-dd;HH:mm:ss.SSS","ISO8601"]
	timezone => "Europe/London"
	target => "EndTime"
	locale=>"en"	

 }

```

}

mutate {  
gsub =\> [ "StartTime"," ",";",  
"EndTime"," ",";"  
]  
}  
}

I am not getting any error, logstash is able to parse StartTime and Endtime fields. But both fields type is set to "string" in Kibana. I need to set it to "date".

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 24, 2017, 6:24am UTC](https://discuss.elastic.co/t/not-able-to-send-multiple-date-fields-in-logstash/83359/2 "2017-04-24T06:24:35Z")

</div>

Can you please reformat your post and use code tags, it's a bit hard to read as is 🙂

---

<div class="post-metadata">

**Author:** ![SanC](https://avatars.discourse-cdn.com/v4/letter/s/9de053/32.png) [@SanC](https://discuss.elastic.co/u/SanC)\
**Post date:** [April 24, 2017, 6:36am UTC](https://discuss.elastic.co/t/not-able-to-send-multiple-date-fields-in-logstash/83359/3 "2017-04-24T06:36:07Z")

</div>

My Log file-  
MachineName|FeedName|Version|InputFileName|LoadType|StartTime|NumOfRecordsinCEMP|NumOfRecordsinStage|Status|Message|EndTime|EventSeverity|Action|time\_taken\_ms  
EDTD-LYNXSQL01|Falcon|2017-04-13\_180858\_7480000|2017-04-13\_180858\_7482003\_urn\_uuid\_67d977da-25c4-4e31-9f84-8a37562662e5.xml|Delta|2017-04-21 10:02:01.827|0|4|Success|File Loaded into DB|2017-04-21 10:37:49.000|Info|I|2147173  
EDTD-LYNXSQL01|Falcon|2017-04-13\_180916\_0290000|2017-04-13\_180916\_0299310\_urn\_uuid\_1d9a9239-fba8-497c-8023-6fe1eec70aaa.xml|Delta|2017-04-21 10:02:03.470|0|1|Success|File Loaded into DB|2017-04-21 10:37:49.000|Info|I|2145530MachineName|FeedName|Version|InputFileName|LoadType|StartTime|NumOfRecordsinCEMP|NumOfRecordsinStage|Status|Message|EndTime|EventSeverity|Action|time\_taken\_ms  
EDTD-LYNXSQL01|Falcon|2017-04-13\_180858\_7480000|2017-04-13\_180858\_7482003\_urn\_uuid\_67d977da-25c4-4e31-9f84-8a37562662e5.xml|Delta|2017-04-21 10:02:01.827|0|4|Success|File Loaded into DB|2017-04-21 10:37:49.000|Info|I|2147173  
EDTD-LYNXSQL01|Falcon|2017-04-13\_180916\_0290000|2017-04-13\_180916\_0299310\_urn\_uuid\_1d9a9239-fba8-497c-8023-6fe1eec70aaa.xml|Delta|2017-04-21 10:02:03.470|0|1|Success|File Loaded into DB|2017-04-21 10:37:49.000|Info|I|2145530

My Logstash config is-

```
filter {
if [type] == "RDS_Logs"{

if [message] =~ /^"MachineName|FeedName|Version"/ {
drop { }
}
  csv {
      separator => "|"
     columns => ["MachineName","FeedName","Version","InputFileName","LoadType","StartTime","NumOfRecordsinCEMP","NumOfRecordsinStage","Status","sp-message","EndTime","EventSeverity","Action","time_taken_ms"]
 	}
	date {
  		match => ["StartTime","YYYY-MM-dd;HH:mm:ss.SSS","ISO8601"]
		timezone => "Europe/London"
		target => "StartTime"
		locale=>"en"	
	 	 }
	date {
  		match => ["EndTime", "YYYY-MM-dd;HH:mm:ss.SSS","ISO8601"]
		timezone => "Europe/London"
		target => "EndTime"
		locale=>"en"	
	 	 }
   }
	
   mutate {
	gsub => [ "StartTime"," ",";",
		    "EndTime"," ",";"
		   ]
}
}

```

I am not getting any error, logstash is able to parse StartTime and Endtime fields. But both fields type is set to "string" in Kibana. I need to set it to "date".

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 24, 2017, 9:49am UTC](https://discuss.elastic.co/t/not-able-to-send-multiple-date-fields-in-logstash/83359/4 "2017-04-24T09:49:14Z")

</div>

You can't change a field's mapping once it has been set (unless you reindex or otherwise recreate your index). Can you try reindexing or create a new index and see if it corrects itself?

---

<div class="post-metadata">

**Author:** ![SanC](https://avatars.discourse-cdn.com/v4/letter/s/9de053/32.png) [@SanC](https://discuss.elastic.co/u/SanC)\
**Post date:** [April 24, 2017, 11:11am UTC](https://discuss.elastic.co/t/not-able-to-send-multiple-date-fields-in-logstash/83359/5 "2017-04-24T11:11:45Z")

</div>

Thanks Magnus..I will recreate index and check

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 22, 2017, 11:24am UTC](https://discuss.elastic.co/t/not-able-to-send-multiple-date-fields-in-logstash/83359/6 "2017-05-22T11:24:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.