# Extract Month and Year from date field
**URL:** https://discuss.elastic.co/t/extract-month-and-year-from-date-field/209090
**Category:** Logstash
**Created:** [November 22, 2019, 4:28pm UTC](https://discuss.elastic.co/t/extract-month-and-year-from-date-field/209090 "2019-11-22T16:28:38Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [November 22, 2019, 4:28pm UTC](https://discuss.elastic.co/t/extract-month-and-year-from-date-field/209090/1 "2019-11-22T16:28:38Z")
I am trying to extract Month from date field. But following is actually extracting month from @timestamp and not from first
```
input {
generator {
message => '{"first_report": "2019-05-30 14:57:59.11"}'
count => 1
}
}
filter {
json { source => "message" }
date { match => ["first_report", "yyyy-MM-dd HH:mm:ss.SS"]
target => "first_report"
add_field => {"month" => "%{+MM}" }
}
mutate { remove_field => ["message","path","host"] }
}
```
Output looks like this. I need month = 05
{
**"month" =\> "11"** ,
"@version" =\> "1",
"@timestamp" =\> 2019-11-22T16:07:57.768Z,
"first\_report" =\> 2019-05-30T19:57:59.110Z,
"sequence" =\> 0
}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 22, 2019, 5:53pm UTC](https://discuss.elastic.co/t/extract-month-and-year-from-date-field/209090/2 "2019-11-22T17:53:37Z")
sprintf date references always use @timestamp. Why not extract the month with grok?
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [November 22, 2019, 5:57pm UTC](https://discuss.elastic.co/t/extract-month-and-year-from-date-field/209090/3 "2019-11-22T17:57:23Z")
Did lot of search and found that this can only be done with grok filter but I never use this filter so I am trying this way but giving me following error. any idea?
```
filter {
json { source => "message" }
date { match => ["first_report", "yyyy-MM-dd HH:mm:ss.SS"]
target => "first_report"
}
grok {
match => { "first_report" => "%{YEAR}-%{MONTH}-%{DAY} %{HOUR}:%{MINUTE}:%{SECOND}.%{SS}" }
}
```
Getting following error.
exception=\>#\,
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [November 22, 2019, 5:58pm UTC](https://discuss.elastic.co/t/extract-month-and-year-from-date-field/209090/4 "2019-11-22T17:58:13Z")
@Badger,
can you help me find what this error is on grok, how to write this.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 22, 2019, 6:01pm UTC](https://discuss.elastic.co/t/extract-month-and-year-from-date-field/209090/5 "2019-11-22T18:01:56Z")
You do not have to match the entire field
```
grok { match => { "first_report" => "^%{YEAR}-%{MONTH:month}" } }
```
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [November 22, 2019, 6:10pm UTC](https://discuss.elastic.co/t/extract-month-and-year-from-date-field/209090/6 "2019-11-22T18:10:15Z")
use try following three all failed
`grok { match => { "first_report" => "^%{YEAR:year}-%{MONTH:month}" } }`
and as you posted
`grok { match => { "first_report" => "^%{YEAR}-%{MONTH:month}" } }`
and
`grok { match => { "first_report" => "^%{YEAR}-%{MONTH}" } }`
All of them failed
{
"@timestamp" =\> 2019-11-22T17:51:39.840Z,
"message" =\> "{"first\_report": "2019-05-30 14:57:59.11"}",
"@version" =\> "1",
tags" =\> [
[0] "\_grokparsefailure"
],
"sequence" =\> 0,
"first\_report" =\> 2019-05-30T19:57:59.110Z
}
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [November 22, 2019, 6:16pm UTC](https://discuss.elastic.co/t/extract-month-and-year-from-date-field/209090/7 "2019-11-22T18:16:54Z")
fixed. found it
found this page which has fixed pattern name
[https://github.com/hpcugent/logstash-patterns/blob/master/files/grok-patterns](https://github.com/hpcugent/logstash-patterns/blob/master/files/grok-patterns)
` grok { match => { "first_report" => "^%{YEAR:year}-%{MONTHNUM:month}" } }`
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [November 22, 2019, 6:17pm UTC](https://discuss.elastic.co/t/extract-month-and-year-from-date-field/209090/8 "2019-11-22T18:17:22Z")
Thank you @Badger
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 20, 2019, 6:17pm UTC](https://discuss.elastic.co/t/extract-month-and-year-from-date-field/209090/9 "2019-12-20T18:17:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.