# Indexer failures for timestamp **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [June 12, 2019, 7:52am UTC](https://community.graylog.org/t/indexer-failures-for-timestamp/10762 "2019-06-12T07:52:54Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![rajnishtyagi](https://avatars.discourse-cdn.com/v4/letter/r/48db29/32.png) [@rajnishtyagi](https://community.graylog.org/u/rajnishtyagi)\ **Post date:** [June 12, 2019, 7:52am UTC](https://community.graylog.org/t/indexer-failures-for-timestamp/10762/1 "2019-06-12T07:52:54Z")
Hi team, i am using graylog version 2.5 and elasticsearch version 6.5.4, right now i am getting some issue with timestamp ``` {"type":"mapper_parsing_exception","reason":"failed to parse field [apiTimestamp] of type [date]","caused_by":{"type":"illegal_argument_exception","reason":"Invalid format: \"12/Jun/2019:07:45:59.055\" is malformed at \"/Jun/2019:07:45:59.055\""}} ``` can someone please suggest me how to fix this error and how to check which logs creating this error because multiple applications sending logs to my graylog ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [June 13, 2019, 8:12am UTC](https://community.graylog.org/t/indexer-failures-for-timestamp/10762/2 "2019-06-13T08:12:14Z")
if you share how you ingest data, you might get someone that helps you finding the malfomed log source ---
**Author:** ![rajnishtyagi](https://avatars.discourse-cdn.com/v4/letter/r/48db29/32.png) [@rajnishtyagi](https://community.graylog.org/u/rajnishtyagi)\ **Post date:** [June 18, 2019, 5:43am UTC](https://community.graylog.org/t/indexer-failures-for-timestamp/10762/3 "2019-06-18T05:43:42Z")
i am using logstash to send logs to graylog. is this what you are looking for ? input { file { path =\> “/opt/lsy/log/test/test.log” type =\> “testlog” } } filter { if [type] == “testlog” { multiline { negate =\> true pattern =\> “^[%{TIMESTAMP\_ISO8601}]” what =\> ‘previous’ } grok { match =\> [“message”, “^[%{TIMESTAMP\_ISO8601:logdate}]%{SPACE}[%{LOGLEVEL:severity}]%{SPACE}[%{DATA:thread}]%{SPACE}[%{DATA:class}]%{SPACE}%{NUMBER:lineNumber}%{SPACE}|%{SPACE}[%{DATA:componentName}]%{SPACE}|%{SPACE}[%{DATA:componentVersion}]%{SPACE}|%{SPACE}[%{DATA:applicationId}]%{SPACE}|%{SPACE}[%{DATA:clientId}]%{SPACE}|%{SPACE}[%{DATA:customerId}]%{SPACE}|%{SPACE}[%{DATA:busId}]%{SPACE}|%{SPACE}[%{DATA:userId}]%{SPACE}|%{SPACE}[%{DATA:testd}]%{SPACE}|%{SPACE}[%{DATA:apiTimestamp}]%{SPACE}|%{SPACE}%{GREEDYDATA}”] } date { match =\> [“logdate”, “ISO8601”] remove\_field =\> [“logdate”] } } if [severity] != “INFO” and [severity] != “WARN” and [severity] != “ERROR” { drop {} } } output { gelf { custom\_fields =\> [‘environment’, ‘{ENVIRONMENT}'] custom\_fields =\> ['service', 'StatusMonitoringService'] custom\_fields =\> ['hostName', '{DOCKER\_HOST}’] custom\_fields =\> [‘containerName’, ‘${CONTAINER\_NAME}’] host =\> “my host” port =\> “my port” full\_message =\> “” ignore\_metadata =\> ["@timestamp", “@version”, “severity”, “host”, “source\_host”, “source\_path”, “short\_message”] } } ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [June 18, 2019, 10:41am UTC](https://community.graylog.org/t/indexer-failures-for-timestamp/10762/4 "2019-06-18T10:41:14Z")
the grok for `%{DATA:apiTimestamp}` will take everything. So if you want to have a timestamp at this, use the pattern for this timestamp that matches. Or create a custom mapping in Elasticsearch for the field `apiTimestamp` that is of the type string that you are able to ingest everything. ---
**Author:** ![rajnishtyagi](https://avatars.discourse-cdn.com/v4/letter/r/48db29/32.png) [@rajnishtyagi](https://community.graylog.org/u/rajnishtyagi)\ **Post date:** [June 18, 2019, 7:40pm UTC](https://community.graylog.org/t/indexer-failures-for-timestamp/10762/5 "2019-06-18T19:40:19Z")
Few questions if I use pattern then it change the date or it will match the pattern and of do not match then ignore it - Is custom mapping making date as string will impect searches ?? - Can we use pipelines to change the date ?? ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [June 19, 2019, 5:42am UTC](https://community.graylog.org/t/indexer-failures-for-timestamp/10762/6 "2019-06-19T05:42:15Z")
- if a pattern does not match, it will be ignored - date, string and number behave different on search, the documentation covers that - yes processing pipelines could do all you do in logstash… ---
**Author:** ![rajnishtyagi](https://avatars.discourse-cdn.com/v4/letter/r/48db29/32.png) [@rajnishtyagi](https://community.graylog.org/u/rajnishtyagi)\ **Post date:** [June 19, 2019, 6:50am UTC](https://community.graylog.org/t/indexer-failures-for-timestamp/10762/7 "2019-06-19T06:50:56Z")
i have multiple application which is feeding logs in graylog, so is it possible we can check which application or container sending wrong date format ? second question: if i got **mapper\_parsing\_exception** for date will that log ignored by the graylog because i can not see specific timestamp log in graylog ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [June 19, 2019, 11:27am UTC](https://community.graylog.org/t/indexer-failures-for-timestamp/10762/8 "2019-06-19T11:27:04Z")
Are you talking about the field `timestamp` or your initial mentioned `apiTimestamp` ? Make a custom mapping for `apiTimestamp` that makes this field a string and look at the field, finding the source with the malformed. Messages are lost when they could not be inserted to Elasticsearch. ---
**Author:** ![rajnishtyagi](https://avatars.discourse-cdn.com/v4/letter/r/48db29/32.png) [@rajnishtyagi](https://community.graylog.org/u/rajnishtyagi)\ **Post date:** [June 20, 2019, 6:40am UTC](https://community.graylog.org/t/indexer-failures-for-timestamp/10762/9 "2019-06-20T06:40:05Z")
after making a custom mapping i can see the culprit services but i am wondering in logstash configuration apiTimestamp is defined **[%{DATA:apiTimestamp}]** then why elasticsearch treating him as a date i think it should treat as string ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [June 21, 2019, 8:55am UTC](https://community.graylog.org/t/indexer-failures-for-timestamp/10762/10 "2019-06-21T08:55:33Z")
You think that the data type is decided on extract - but the dataype is decided on field creation in Elasticsearch. If the first ingested value is a number, the field will be a number. If it is a date, the field will be a date. Only having a custom mapping is forcing a specific type. It does not matter what and how you extract - it does matter what you ingest. Also after index rotation the game starts over again! ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [July 5, 2019, 8:55am UTC](https://community.graylog.org/t/indexer-failures-for-timestamp/10762/11 "2019-07-05T08:55:33Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.