# Wrong argument type string expected Timestamp

**URL:** <https://discuss.elastic.co/t/wrong-argument-type-string-expected-timestamp/216229>\
**Category:** Logstash\
**Created:** [January 23, 2020, 11:41am UTC](https://discuss.elastic.co/t/wrong-argument-type-string-expected-timestamp/216229 "2020-01-23T11:41:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![morpheus](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@morpheus](https://discuss.elastic.co/u/morpheus)\
**Post date:** [January 23, 2020, 11:41am UTC](https://discuss.elastic.co/t/wrong-argument-type-string-expected-timestamp/216229/1 "2020-01-23T11:41:45Z")

</div>

Greetings,

I have seen other similar threads to this but not able to solve my problem, I am getting the error:

> [2020-01-22T10:45:38,409][WARN][logstash.inputs.gelf] Gelf (tcp): client socket failed. {:exception=\>#\<TypeError: wrong argument type String (expected LogStash::Timestamp)\>, :backtrace=\>["org/logstash/ext/JrubyEventExtLibrary.java:95:in `set'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-gelf-3.2.0/lib/logstash/inputs/gelf.rb:281:in `block in strip\_leading\_underscore'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-gelf-3.2.0/lib/logstash/inputs/gelf.rb:279:in `strip\_leading\_underscore'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-gelf-3.2.0/lib/logstash/inputs/gelf.rb:161:in `block in tcp\_listener'"]}

When I turn off the winlogbeats prefix to send in GELF format. So before the fields it is sending look like this:

WITH PREFIX (works)

timestamp":1.579706245057E9  
_winlogbeat_ @timestamp":“2020-01-22T15:17:25.057Z  
\_timestamp”:"2020-01-22T15:17:25.057Z

WITHOUT PREFIX (doesn’t work)

timestamp":1.579703908066E9  
\_timestamp":“2020-01-22T14:38:28.066Z  
\_@timestamp”:"2020-01-22T14:38:28.066Z

How do I know which field is causing Logstash its issues and reference that field in order to correct it?

Many Thanks.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 23, 2020, 1:53pm UTC](https://discuss.elastic.co/t/wrong-argument-type-string-expected-timestamp/216229/2 "2020-01-23T13:53:51Z")

</div>

> [@morpheus](#):
>
> How do I know which field is causing Logstash its issues

The [code](https://github.com/logstash-plugins/logstash-input-gelf/blob/76c111f32160c5c92c6f440d7ac5f73af68e57f7/lib/logstash/inputs/gelf.rb#L269) is removing the leading underscore from the fieldname. You appear to have a field called \_@timestamp, so that would result in a field called @timestamp. I think logstash expect @timestamp to be a LogStash::Timestamp, not a string.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 20, 2020, 1:53pm UTC](https://discuss.elastic.co/t/wrong-argument-type-string-expected-timestamp/216229/3 "2020-02-20T13:53:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.