# Log message that fails index due to missing data stream timestamp
**URL:** https://forum.opensearch.org/t/log-message-that-fails-index-due-to-missing-data-stream-timestamp/21610
**Category:** OpenSearch
**Created:** [September 23, 2024, 2:05pm UTC](https://forum.opensearch.org/t/log-message-that-fails-index-due-to-missing-data-stream-timestamp/21610 "2024-09-23T14:05:24Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@coredump17](https://forum.opensearch.org/u/coredump17)
#### Post date: [September 23, 2024, 2:05pm UTC](https://forum.opensearch.org/t/log-message-that-fails-index-due-to-missing-data-stream-timestamp/21610/1 "2024-09-23T14:05:24Z")
versions: 2.16
Hi All, i use vector to index into opensearch. I appear to have the odd message that is making its way through which is not meeting the needs for a data stream index - likely missing timestamp. I am unable to find how that is getting through the flow at the moment.
Can opensearch log the message vector is posting that it does not like ? I am posting in batches so difficult to see in vector.
---
### Author:  [@Eugene7](https://forum.opensearch.org/u/Eugene7)
#### Post date: [September 24, 2024, 12:03pm UTC](https://forum.opensearch.org/t/log-message-that-fails-index-due-to-missing-data-stream-timestamp/21610/2 "2024-09-24T12:03:09Z")
Hi @coredump17 ,
How do you ingest data? Do you use any ingestion tools?
To see more detailed OpenSearch logs, you can try switching the log level to `debug` or `trace` mode:
> **[Logs](https://opensearch.org/docs/2.16/install-and-configure/configuring-opensearch/logs/#application-logs)**
>
> Logs
---
### Author:  [@coredump17](https://forum.opensearch.org/u/coredump17)
#### Post date: [September 24, 2024, 7:37pm UTC](https://forum.opensearch.org/t/log-message-that-fails-index-due-to-missing-data-stream-timestamp/21610/3 "2024-09-24T19:37:18Z")
hi @Eugene7 ,
i use vector.dev (vrl) to ingest many different log formats via a kafka feed.
---
### Author:  [@Eugene7](https://forum.opensearch.org/u/Eugene7)
#### Post date: [October 1, 2024, 2:32pm UTC](https://forum.opensearch.org/t/log-message-that-fails-index-due-to-missing-data-stream-timestamp/21610/4 "2024-10-01T14:32:12Z")
Could you please send an example of your ingest data? Do you use k-NN vectors in your OpenSearch cluster to store the data? Do you have any error massages in the OpenSearch logs?
According to the documentation [here](https://opensearch.org/docs/latest/im-plugin/data-streams/#step-3-ingest-data-into-the-data-stream), you must have a timestamp field for a data stream object. But it’s possible to define your own custom timestamp parameter in the `data_stream` object. There are other ways to ingest ingest data with no required timestamp parameter. Please have a look at the following documentation:
> **[Ingest data](https://opensearch.org/docs/latest/getting-started/ingest-data/)**
>
> Ingest your data into OpenSearch
---
### Author:  [@coredump17](https://forum.opensearch.org/u/coredump17)
#### Post date: [October 6, 2024, 6:20pm UTC](https://forum.opensearch.org/t/log-message-that-fails-index-due-to-missing-data-stream-timestamp/21610/5 "2024-10-06T18:20:25Z")
Hi. Thanks for your time. It would appear the issue is with my interpretation of vector.dev VRL. [Remap with VRL | Vector documentation](https://vector.dev/docs/reference/configuration/transforms/remap/#drop_on_error) is set to false so we had some timestamps not in the correct format but passing the regex test and then leaving it up to opensearch to reject.