Error log: This is a specific, and very common, type of MapperParsingException (Blog #6). You’ll see it as a failure in a bulk request.
JSON
None
{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "failed to parse field [@timestamp] of type [date]...
Preview of field's value: '03/Nov/2025:10:30:00 +0000'"
}
],
"type": "mapper_parsing_exception",
"reason": "failed to parse field [@timestamp] ...",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "failed to parse date field [03/Nov/2025:10:30:00 +0000]...
Cannot parse '03/Nov/2025:10:30:00 +0000':
Value 'Nov' at index 3 is not supported for 'MONTH_OF_YEAR'"
}
},
"status": 400
}Why… is this happening? This error means you sent a string value for a date field, but the string’s format does not match any of the formats OpenSearch was told to expect.
By default, OpenSearch’s date fields are configured to accept standard formats like ISO 8601 (e.g., 2025-11-03T10:30:00Z) or epoch milliseconds.
Your log, in the example above, is sending a “Common Log Format” date (03/Nov/2025...), which the default parser does not understand. The parser tried to read Nov as a number (for MONTH_OF_YEAR) and failed.
Best practice:
1. Standardize at the source (Best): The best solution is to fix your ingest client (Logstash, Filebeat, your app). Before sending the JSON, parse the custom date string and reformat it into the standard ISO 8601 format. This makes your data clean and universally compatible.
2. Use an ingest pipeline: If you can’t fix the client, use an OpenSearch ingest pipeline with a date processor. This pipeline intercepts the document before it’s indexed, parses the non-standard date, and converts it to the correct format.
3. Add the format to your mapping (The “Fix-it-here” way): You can explicitly tell OpenSearch to accept your custom format. You must define this in your index mapping before sending data.
JSON
None
PUT /_index_template/my_logs_template
{
"index_patterns": ["my-logs-*"],
"template": {
"mappings": {
"properties": {
"@timestamp": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis||dd/MMM/yyyy:HH:mm:ss Z"
}
}
}
}
}
4. The || acts as an “OR”. Here, we added the custom format dd/MMM/yyyy:HH:mm:ss Z to the list of accepted formats.
What else can I do? Date parsing is a common headache. The date processor and custom mapping formats are powerful. If you’re stuck on the right format string, ask the OpenSearch community or check the Java DateTimeFormatter docs. For direct help, contact us in The OpenSearch Slack Channel in #General.
