# "reason"=\>"failed to parse field \[Time\] of type \[date\] in document with id 'xxxxxxxxxxxxxxx'
**URL:** https://discuss.elastic.co/t/reason-failed-to-parse-field-time-of-type-date-in-document-with-id-xxxxxxxxxxxxxxx/267473
**Category:** Logstash
**Created:** [March 17, 2021, 10:37am UTC](https://discuss.elastic.co/t/reason-failed-to-parse-field-time-of-type-date-in-document-with-id-xxxxxxxxxxxxxxx/267473 "2021-03-17T10:37:16Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@BlackCat](https://discuss.elastic.co/u/BlackCat)
#### Post date: [March 17, 2021, 10:37am UTC](https://discuss.elastic.co/t/reason-failed-to-parse-field-time-of-type-date-in-document-with-id-xxxxxxxxxxxxxxx/267473/1 "2021-03-17T10:37:16Z")
I set config of logstash, But happen warning message.
Please, how to do resolve.
I want to send below log to Elasticsearch.
//////////////////
2021-03-17 10:27:50.115 +0900 26240 main : INFO com.tableausoftware.activemq.ActiveMQApp - OK
//////////////////
logstash config
```auto
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:Time} %{ISO8601_TIMEZONE} %{GREEDYDATA:Message}" }
}
```
warning message
```auto
[2021-03-17T19:27:55,351][WARN][logstash.outputs.elasticsearch][main][9002db901028329940eb5fba931f1c415dff0a351278ecd055258afdbfcd922b] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"server_log", :routing=>nil, :_type=>"_doc"}, #], :response=>{"index"=>{"_index"=>"server_log", "_type"=>"_doc", "_id"=>"pqu6P3gBhQBy17rcRRFT", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [Time] of type [date] in document with id 'pqu6P3gBhQBy17rcRRFT'. Preview of field's value: '2021-03-17 10:27:00.115'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"failed to parse date field [2021-03-17 10:27:00.115] with format [strict_date_optional_time||epoch_millis]", "caused_by"=>{"type"=>"date_time_parse_exception", "reason"=>"Failed to parse with all enclosed parsers"}}}}}}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 17, 2021, 4:23pm UTC](https://discuss.elastic.co/t/reason-failed-to-parse-field-time-of-type-date-in-document-with-id-xxxxxxxxxxxxxxx/267473/2 "2021-03-17T16:23:28Z")
> [@BlackCat](#):
>
> `"caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"failed to parse date field [2021-03-17 10:27:00.115] with format [strict\_date\_optional\_time||epoch\_millis]",
elasticsearch expects the [Time] field to be a date. Either you have a mapping that tells it that, or it has previously decided that using [dynamic mapping](https://www.elastic.co/guide/en/elasticsearch/reference/7.11/dynamic-field-mapping.html#date-detection).
The [date parser](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html) defaults to strict\_date\_optional\_time or epoch\_millis.
strict\_date\_optional\_time is "A generic ISO datetime parser, where the date must include the year at a minimum, and the time (separated by T), is optional. Examples: yyyy-MM-dd'T'HH:mm:ss.SSSZ or yyyy-MM-dd."
So you can use mutate+gsub to change the " " to "T" in "2021-03-17 10:27:00.115", or else use a date filter to parse the field and overwrite it, in which case the elasticsearch output will send it to elasticsearch in an appropriate format.
---
### Author:  [@BlackCat](https://discuss.elastic.co/u/BlackCat)
#### Post date: [March 22, 2021, 12:26am UTC](https://discuss.elastic.co/t/reason-failed-to-parse-field-time-of-type-date-in-document-with-id-xxxxxxxxxxxxxxx/267473/3 "2021-03-22T00:26:35Z")
I added below config.
It work.
mutate+gsub
```auto
mutate {
gsub => ["Time", " ", "T"]
}
```
Thank you for your advise.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 19, 2021, 12:27am UTC](https://discuss.elastic.co/t/reason-failed-to-parse-field-time-of-type-date-in-document-with-id-xxxxxxxxxxxxxxx/267473/4 "2021-04-19T00:27:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.