# Why i can't add a date field **URL:** \ **Category:** Logstash\ **Created:** [April 13, 2018, 7:44am UTC](https://discuss.elastic.co/t/why-i-cant-add-a-date-field/127922 "2018-04-13T07:44:14Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![chenzilong444](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\ **Post date:** [April 13, 2018, 7:44am UTC](https://discuss.elastic.co/t/why-i-cant-add-a-date-field/127922/1 "2018-04-13T07:44:14Z")
``` filter { grok{ match => [ "message","\[%{TIMESTAMP_ISO8601:TimeStamp}\]" ] } date { match => ["TimeStamp", "ISO8601"] target => "timestamp" timezone => "Asia/Shanghai" } } ``` i input [2018-04-13 15:00:00.000] [2018-04-13T15:36:14,470][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\> "logstash(2018.04.13)", :\_type=\>"logstash", :\_routing=\>nil}, #\], :response=\>{"index"=\>{"\_index"=\>"logstash(2018.04.13)", "\_type"=\>"l ogstash", "\_id"=\>"g0vuvWIBoK0nbYCH664-", "status"=\>400, "error"=\>{"type"=\>"mappe r\_parsing\_exception", "reason"=\>"failed to parse [TimeStamp]", "caused\_by"=\>{"ty pe"=\>"illegal\_argument\_exception", "reason"=\>"Invalid format: "2018-04-13 15:00 :00.000" is malformed at " 15:00:00.000""}}}}} { "@timestamp" =\> 2018-04-13T07:36:14.303Z, "host" =\> "BIH-D-6331", "@version" =\> "1", "TimeStamp" =\> "2018-04-13 15:00:00.000", "message" =\> "[2018-04-13 15:00:00.000]\r", "timestamp" =\> 2018-04-13T07:00:00.000Z } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 13, 2018, 7:47am UTC](https://discuss.elastic.co/t/why-i-cant-add-a-date-field/127922/2 "2018-04-13T07:47:54Z")
Do you really need to keep the `TimeStamp` field that it's complaining about? If you remove it this problem will go away. ---
**Author:** ![chenzilong444](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\ **Post date:** [April 13, 2018, 7:51am UTC](https://discuss.elastic.co/t/why-i-cant-add-a-date-field/127922/3 "2018-04-13T07:51:21Z")
so if i add a new date field i need remove original field？ ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 13, 2018, 8:08am UTC](https://discuss.elastic.co/t/why-i-cant-add-a-date-field/127922/4 "2018-04-13T08:08:57Z")
No, you can have as many date fields as you like. But ES apparently doesn't recognize "2018-04-13 15:00 :00.000" as a date. If you want to store it in a field you have to make sure it's a string field. ---
**Author:** ![chenzilong444](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\ **Post date:** [April 13, 2018, 8:12am UTC](https://discuss.elastic.co/t/why-i-cant-add-a-date-field/127922/5 "2018-04-13T08:12:02Z")
but when i changed TimeStamp it become ufc time zone ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 13, 2018, 9:51am UTC](https://discuss.elastic.co/t/why-i-cant-add-a-date-field/127922/6 "2018-04-13T09:51:21Z")
You're not changing `TimeStamp` so I don't know what you mean, but the date filter always produces UTC timestamps. ---
**Author:** ![chenzilong444](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\ **Post date:** [April 13, 2018, 10:16am UTC](https://discuss.elastic.co/t/why-i-cant-add-a-date-field/127922/7 "2018-04-13T10:16:30Z")
so how can i make a date field by my own time zone ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 13, 2018, 10:59am UTC](https://discuss.elastic.co/t/why-i-cant-add-a-date-field/127922/8 "2018-04-13T10:59:00Z")
My answer in [I want to save index by my own time zone](https://discuss.elastic.co/t/i-want-to-save-index-by-my-own-time-zone/127918) applies here too. ---
**Author:** ![chenzilong444](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\ **Post date:** [April 16, 2018, 7:51am UTC](https://discuss.elastic.co/t/why-i-cant-add-a-date-field/127922/9 "2018-04-16T07:51:33Z")
thank you .you are right but now i find a new problem that when i use date\_histogram ``` "aggs" : { "salestime" : { "date_histogram" : { "field" : "@timestamp", "interval" : "day" }, } } "aggregations": { "salestime": { "buckets": [ { "key_as_string": "2018-04-02T00:00:00.000Z", "key": 1522627200000, ``` it use utc time zone . so can i use my time zone at here? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 16, 2018, 7:52am UTC](https://discuss.elastic.co/t/why-i-cant-add-a-date-field/127922/10 "2018-04-16T07:52:56Z")
I don't know. I suggest you post a new topic in the Elasticsearch category as this isn't a Logstash question. ---
**Author:** ![chenzilong444](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\ **Post date:** [April 16, 2018, 7:56am UTC](https://discuss.elastic.co/t/why-i-cant-add-a-date-field/127922/11 "2018-04-16T07:56:35Z")
ok thank you ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 14, 2018, 7:56am UTC](https://discuss.elastic.co/t/why-i-cant-add-a-date-field/127922/12 "2018-05-14T07:56:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.