# Saved field "logdate" of data view "app\*" is invalid for use with the "Date Histogram" aggregation

**URL:** <https://discuss.elastic.co/t/saved-field-logdate-of-data-view-app-is-invalid-for-use-with-the-date-histogram-aggregation/300868>\
**Category:** Elasticsearch\
**Created:** [March 28, 2022, 3:35pm UTC](https://discuss.elastic.co/t/saved-field-logdate-of-data-view-app-is-invalid-for-use-with-the-date-histogram-aggregation/300868 "2022-03-28T15:35:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![userR](https://avatars.discourse-cdn.com/v4/letter/u/22d042/32.png) [@userR](https://discuss.elastic.co/u/userR)\
**Post date:** [March 28, 2022, 3:35pm UTC](https://discuss.elastic.co/t/saved-field-logdate-of-data-view-app-is-invalid-for-use-with-the-date-histogram-aggregation/300868/1 "2022-03-28T15:35:27Z")

</div>

Recently, we upgraded our production machine which meant I would have to re-deploy Filebeat on this new server. All the log paths and log formats are the same, however, for whatever reason, it is having an issue with logdate.

This was not an issue with the old production server so I am a little confused why it is an issue with the new server with the same log data.

```auto
    date {
      match => ["logdate", "yyyy-MM-dd HH:mm:ss,SSS"]
      target => "logdate"
      timezone => "US/Pacific"
    }

```

Nothing in my configuration has changed. This is what I see when I use the timestamp date histogram.

 ![Screen Shot 2022-03-28 at 8.34.44 AM](https://us1.discourse-cdn.com/elastic/original/3X/e/3/e3d16eba057ad66e4a03550c6fc284e65807d6bd.png)

---

<div class="post-metadata">

**Author:** ![userR](https://avatars.discourse-cdn.com/v4/letter/u/22d042/32.png) [@userR](https://discuss.elastic.co/u/userR)\
**Post date:** [March 28, 2022, 3:48pm UTC](https://discuss.elastic.co/t/saved-field-logdate-of-data-view-app-is-invalid-for-use-with-the-date-histogram-aggregation/300868/2 "2022-03-28T15:48:20Z")

</div>

It looks like the new prod actually added more info to the log date. Previously, it was something like:

```auto
2022-03-25 15:59:44,351

```

Now it has added that extra -0700. Seems like an easy fix, will logdate still have an issue since some logs will contain the -700 while others wont?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2022, 3:49pm UTC](https://discuss.elastic.co/t/saved-field-logdate-of-data-view-app-is-invalid-for-use-with-the-date-histogram-aggregation/300868/3 "2022-04-25T15:49:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.