Error getting Windows Logs into GrayLog

[jan (Jan Doberstein)]

on first ingest hostname was detected as date - and 13 is not a valid one for month …

so the solution:

Field [winlogbeat_host_name] of type [date]

He @Larsman this can happen because Elasticsearch tries on ingest to detect the type of data. So if a field is created the first time - that content type is used until the next index is created. Best option you have - force specific content types with index templates. http://docs.graylog.org/en/3.1/pages/configuration/elasticsearch.html#custom-index-mappings