title: Logstash/ElasticSearch: guesses wrong for datatype for field
body: <p>The log files I'm trying to import into Logstash contain a field that sometimes looks like a date/time and sometimes does not.  Unfortunately, the first occurrence looked like a date/time and someone (logstash or elasticsearch) decided to define the field as a date/time.  When trying to import a later log record, Elasticsearch has an exception:</p>
  
  <pre><code>Failed to execute [index ...]  
  org.elasticsearch.index.mapper.MapperParsingException: Failed to parse [@fields.field99]  
  at org.elasticsearch.index.mapper.core.AbstractFieldMapper.parse(AbstractFieldMapper.java:320)  
  at org.elasticsearch.index.mapper.object.ObjectMapper.serializeValue(ObjectMapper.java:587)  
  ...  
  Caused by: java.lang.IllegalArgumentException: Invalid format: "empty"  
  at org.elasticsearch.common.joda.time.format.DateTimeFormatter.parseMillis(DateTimeFormatter.java:747)  
  ...  
  </code></pre>
  
  <p><strong>Question</strong>: How do I tell logstash/elasticsearch to not define this field as a date/time?  I would like all the fields from my log (except the one explicit timestamp field) to be defined as just text.</p>
  
  <p><strong>Question</strong>: it appears that logstash gives up trying to import records from the log file after seeing this one that elasticsearch throws an exception on.  How can I tell logstash to ignore this exception and keep trying to import the other records from the log file?</p>