# Unable to force date field type inside my indexes

**URL:** <https://community.graylog.org/t/unable-to-force-date-field-type-inside-my-indexes/36936>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [February 2, 2026, 5:50pm UTC](https://community.graylog.org/t/unable-to-force-date-field-type-inside-my-indexes/36936 "2026-02-02T17:50:02Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Theoooooo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/theoooooo/32/18406_2.png) [@Theoooooo](https://community.graylog.org/u/Theoooooo)\
**Post date:** [February 2, 2026, 5:50pm UTC](https://community.graylog.org/t/unable-to-force-date-field-type-inside-my-indexes/36936/1 "2026-02-02T17:50:02Z")

</div>

Hello everyone

I’ve been struggling on this issue for the past few days and i’m seeking any recommandation or explaination on how i can fix this issue

I currently have multiple ubuntu servers which are sending logs through rsyslog (tcp with tls) to two HA HAproxy, which forward the logs with tcp mode configured to my graylog cluster composed of three servers

I have my input configured, my logs are being received by graylog and i currently have a pipeline configured with different steps configured like this :

> rule “Parse SYSLOG3164”  
> when  
> has\_field(  
> field : “full\_message”  
> )  
> then  
> let gl2\_fragment\_grok\_results = grok(  
> pattern: “%{SYSLOG3164}”,  
> value: to\_string($message.full\_message),  
> only\_named\_captures: true  
> );  
> set\_field(“parsed”, “ok”);  
> end

> rule “Fix Timestamp”  
> when  
> has\_field(“timestamp”)  
> then  
> let str = to\_string($message.timestamp);  
> set\_field(“timestamp”,  
> to\_date(  
> format\_date(  
> flex\_parse\_date(str),  
> “yyyy-MM-dd HH:mm:ss”  
> )  
> )  
> );  
> end

All of the fields are being parsed properly, my only issue is all of my indexes have the field type **text** instead of **date**.

I already have a index\_pattern configured inside my elasticsearch cluster, but graylog refuse to use it and always create a mapping on it’s own, missing my key configuration inside my index\_pattern (setting all timestamp fields to **date** type)

I also can’t configure my type inside index set templates, the timestamp field is greyed out and it’s marked as **Reserved field**

Any feedback on how can i fix my field type or make graylog understand that, timestamp is indeed a date field ? Because of this issue i can’t search through my logs because graylog don’t recognise my timestamp field as date

I tried multiple pipeline configuration without any sucess, i though **to\_date** would fix the field type to date as said inside the graylog webui from the quick reference (“Converts a type to a date …”)

My timestamp at the end looks like this when extracting content from my indexes

> “timestamp”: “2026-02-02 17:35:15.000”,

I’m currently running graylog 6.2.1 with a Elasticsearch 7.10.2 behind (also on three servers)

Thanks

---

<div class="post-metadata">

**Author:** ![Wine\_Merchant](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/wine_merchant/32/14596_2.png) [@Wine\_Merchant](https://community.graylog.org/u/Wine_Merchant)\
**Post date:** [February 4, 2026, 9:14am UTC](https://community.graylog.org/t/unable-to-force-date-field-type-inside-my-indexes/36936/2 "2026-02-04T09:14:16Z")

</div>

@Theoooooo,

When looking at the fields view form the search context, what data type do you see timestamp listed as? The default template should be storing it as date.

 ![Screenshot 2026-02-04 at 09.12.32](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/6/c/6ca3c75e3ef312807fbb64c6e615394a96008c26.png)

---

<div class="post-metadata">

**Author:** ![Theoooooo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/theoooooo/32/18406_2.png) [@Theoooooo](https://community.graylog.org/u/Theoooooo)\
**Post date:** [February 4, 2026, 12:38pm UTC](https://community.graylog.org/t/unable-to-force-date-field-type-inside-my-indexes/36936/3 "2026-02-04T12:38:59Z")

</div>

From what i can see, the timestamp is being stored as a string / text field type

I tried forcing it as date inside my pipeline without success

I also have my index\_pattern configured but graylog doesn’t seems to take it in account when rotating my index on a daily basis, or rotating manually

---

<div class="post-metadata">

**Author:** ![Wine\_Merchant](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/wine_merchant/32/14596_2.png) [@Wine\_Merchant](https://community.graylog.org/u/Wine_Merchant)\
**Post date:** [February 4, 2026, 12:59pm UTC](https://community.graylog.org/t/unable-to-force-date-field-type-inside-my-indexes/36936/4 "2026-02-04T12:59:41Z")

</div>

I would have thought, if the timestamp was being stored as a string that none of the logs would be searchable via the UI.

Could you post the template being applied and the current field mappings here?

---

<div class="post-metadata">

**Author:** ![rom\_c](https://avatars.discourse-cdn.com/v4/letter/r/3ec8ea/32.png) [@rom\_c](https://community.graylog.org/u/rom_c)\
**Post date:** [February 4, 2026, 6:46pm UTC](https://community.graylog.org/t/unable-to-force-date-field-type-inside-my-indexes/36936/5 "2026-02-04T18:46:37Z")

</div>

In **Graylog** , changing the pipeline alone doesn’t update the mapping — the field stays `text` until the index template is updated.  
Use **Change field type → Date** in the UI and rotate the index so the new mapping is applied.

---

<div class="post-metadata">

**Author:** ![Theoooooo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/theoooooo/32/18406_2.png) [@Theoooooo](https://community.graylog.org/u/Theoooooo)\
**Post date:** [February 6, 2026, 10:44am UTC](https://community.graylog.org/t/unable-to-force-date-field-type-inside-my-indexes/36936/6 "2026-02-06T10:44:06Z")

</div>

I can’t set the field via **Change field type → Date,** the timestamp field is grayed out and it says “Field is Reserved” something like that

I may have found a solution tho, after messing around i updated my index and added the option field “priority” inside, and i set it to 500.

I read on another post that Graylog use priorities when creating indexes that are higher than the default value Elasticsearch use when creating indexes (via Graylog)

Setting the priority to 500 bypass the priority issue and actually use my provided template

You can see a exemple here : [docs/manage-data/data-store/templates#index-templates](https://www.elastic.co/docs/manage-data/data-store/templates#index-templates)

This issue is now resolved

Thanks for the advices and your time

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [February 20, 2026, 10:44am UTC](https://community.graylog.org/t/unable-to-force-date-field-type-inside-my-indexes/36936/7 "2026-02-20T10:44:19Z")

</div>

Closed on February 20, 2026, 10:44am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.