# Unable to match @timestamp to field created after creating dynamic mapping

**URL:** <https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912>\
**Category:** Logstash\
**Created:** [April 2, 2019, 6:05am UTC](https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912 "2019-04-02T06:05:40Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [April 2, 2019, 6:05am UTC](https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912/1 "2019-04-02T06:05:40Z")

</div>

Hello,

I have created dynamic mapping  
{"doc": {  
"date\_detection": true,  
"dynamic\_date\_formats": "yyyy-MM-dd HH:mm:ss",

```
             "properties": {
                "created": { "type": "date",
                  "format": "yyyy-MM-dd HH:mm:ss"
                },
                 "modified": { "type": "date",
                  "format": "yyyy-MM-dd HH:mm:ss"
                },
                 "@timestamp": { "type": "date",
                  "format": "strict_date_optional_time"
                }
             },
             "dynamic_templates": [
               {
                 "integers": {
                   "match_mapping_type": "long",
                   "mapping": {
                     "type": "integer"
                   }
                 }
               },
               {
                 "strings": {
                   "match_mapping_type": "string",
                   "mapping": {
                     "type": "keyword"
                       }
                     }
                   }
             ]
           }
         }

```

when I am passing data without dynamic mappings the

date {  
match =\> ["created", "yyyy-MM-dd HH:mm:ss"]  
target =\> "@timestamp"  
}

It is matching properly

But, When i am using this config after creating dynamic Mapping it's not working.  
@timestamp field is 11 hr back as compared to created field.

A help would be really appreciated 🙂

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 2, 2019, 6:07am UTC](https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912/2 "2019-04-02T06:07:33Z")

</div>

All timestamps stored in Elasticsearch must be in UTC timezone. Which timezone are your timestamps expressed in?

---

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [April 2, 2019, 6:18am UTC](https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912/3 "2019-04-02T06:18:44Z")

</div>

hello @Christian_Dahlqvist  
thankyou for the response,

I am picking the data from local system

{"received":"2019-02-01 00:00:00","ipaddress":"\_","response\_text":"Thank you for contacting }

my data is of this format and I am renaming received to created and after that matching it to @timestamp

Regards

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 2, 2019, 7:34am UTC](https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912/4 "2019-04-02T07:34:57Z")

</div>

What time zone is that time stamp in? Are you using the date filter to populate @timestamp?

---

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [April 2, 2019, 8:56am UTC](https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912/5 "2019-04-02T08:56:57Z")

</div>

@Christian_Dahlqvist its the browser time

---

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [April 3, 2019, 7:25am UTC](https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912/6 "2019-04-03T07:25:05Z")

</div>

@Christian_Dahlqvist  
can you Please help me out with this

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 3, 2019, 8:58am UTC](https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912/7 "2019-04-03T08:58:20Z")

</div>

Have you verified that the date filter converts this into the correct UTC time stamp?

---

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [April 3, 2019, 9:15am UTC](https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912/8 "2019-04-03T09:15:16Z")

</div>

@Christian_Dahlqvist when i am not using dynamic mapping than this config is working pretty well and i am getting my @timestamp matched

date {  
match =\> ["created", "yyyy-MM-dd HH:mm:ss"]  
target =\> "@timestamp"  
}

but when i create the dynamic mapping I am facing the error

one sample log is  
April 1st 2019, 05:29:59.000 @version:  
@timestamp March 31st 2019, 23:59:59.000

* * *

**t** @version 1  
**t** \_id guWf3WkBY7Thni\_1DFyI  
**#** \_score -  
**t** \_type doc  
**t** beat.hostname localhost.localdomain  
**t** beat.name localhost.localdomain  
**t** beat.version 6.2.4  
created April 1st 2019, 05:29:59.000  
**t**

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 3, 2019, 9:27am UTC](https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912/9 "2019-04-03T09:27:03Z")

</div>

Can you paste the JSON document as well as the mapping here?

---

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [April 3, 2019, 9:36am UTC](https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912/10 "2019-04-03T09:36:15Z")

</div>

@Christian_Dahlqvist thanks a lot for response

my sample log is

{"no":"12344","message":"urgent","network":"bigdata","shortcode":"1234","received":"2019-02-01 00:00:01","ipaddress":"\*\*\*"}

my dynamic mapping is

PUT /index\_name  
{  
"settings" : {  
"index" : {  
"number\_of\_shards" : 2,  
"number\_of\_replicas" : 0  
}  
},  
"mappings": {  
"doc": {  
"date\_detection": true,  
"dynamic\_date\_formats": "yyyy-MM-dd HH:mm:ss",

```
 "properties": {
    "created": { "type": "date",
      "format": "yyyy-MM-dd HH:mm:ss"
    }
 },
 "dynamic_templates": [
   {
     "integers": {
       "match_mapping_type": "long",
       "mapping": {
         "type": "integer"
       }
     }
   },
   {
     "strings": {
       "match_mapping_type": "string",
       "mapping": {
         "type": "keyword"
           }
         }
       }
 ]

```

}  
}  
}

my logstash config file is

input {  
beats {  
port =\> 5044  
}  
}  
filter {  
json {  
source =\> "message"  
}  
mutate {  
rename =\> ["received", "created"]  
}  
mutate {  
remove\_field =\> ["some\_fields"]  
}  
date {  
match =\> ["created", "yyyy-MM-dd HH:mm:ss"]  
target =\> "@timestamp"  
}  
}  
output{  
elasticsearch {  
hosts =\> "IP:9200"  
index =\> "index\_name"  
}  
stdout{}  
}

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 3, 2019, 9:39am UTC](https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912/11 "2019-04-03T09:39:35Z")

</div>

Do not specify a date format in your dynamic mapping as that does not seem to match the default that the date filter produces. What happens if you use the default mappings and do not specify any dynamic mappings?

---

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [April 3, 2019, 9:41am UTC](https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912/12 "2019-04-03T09:41:36Z")

</div>

@Christian_Dahlqvist than what should be the format for dynamic mapping for date format  
can you please write is for me

Regards

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 3, 2019, 9:43am UTC](https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912/13 "2019-04-03T09:43:09Z")

</div>

If you do not specify it explicitly, the default should be used which should work.

---

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [April 3, 2019, 9:45am UTC](https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912/14 "2019-04-03T09:45:24Z")

</div>

@Christian_Dahlqvist should the dynamic\_date\_formats  
and date format for field created be default format?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 3, 2019, 9:48am UTC](https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912/15 "2019-04-03T09:48:15Z")

</div>

Try indexing your data into a new index without any custom template (use the dynamic defaults) and check how that works out.

---

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [April 3, 2019, 11:02am UTC](https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912/16 "2019-04-03T11:02:17Z")

</div>

@Christian_Dahlqvist my new dynamic mapping is

PUT /environment  
{  
"settings" : {  
"index" : {  
"number\_of\_shards" : 2,  
"number\_of\_replicas" : 0  
}  
},  
"mappings": {  
"doc": {  
"date\_detection": true,

```
 "properties": {
    "created": { "type": "date"
    }
 },
 "dynamic_templates": [
   {
     "integers": {
       "match_mapping_type": "long",
       "mapping": {
         "type": "integer"
       }
     }
   },
   {
     "strings": {
       "match_mapping_type": "string",
       "mapping": {
         "type": "keyword"
           }
         }
       }
 ]

```

}  
}  
}

I am still facing issue  
Please help me

---

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [April 3, 2019, 11:07am UTC](https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912/17 "2019-04-03T11:07:55Z")

</div>

solved..

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2019, 11:08am UTC](https://discuss.elastic.co/t/unable-to-match-timestamp-to-field-created-after-creating-dynamic-mapping/174912/18 "2019-05-01T11:08:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.