How to convert @timestamp value to yyyyMM in logstash pipeline

Elastic Stack Logstash
1

I am very new joiner in logstash pipeline:

I want to indexed @timestamp value format as yyyyMM, example "202411"

Incomming BillingMonth value ="202411"

Logstash Pipeline:
filter {
event.set("@timestamp", event.get("BillingMonth"))
}

Index Mapping:
{
"mappings": {
"properties": {
"@timestamp": {
"type": "date",
"format": "yyyyMM"
},
...
}

but anyway , I alway get logstash error like

"caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"failed to parse date field [2024-11-12T13:10:52.598709Z] with format [yyyyMM]", "caused_by"=>{"type"=>"date_time_parse_exception", "reason"=>"Text '2024-11-12T13:10:52.598709Z' could not be parsed at index 4"}

How can I solve it?

2

Your mapping says @timestamp should be in the format yyyyMM, but the text that you sent (2024-11-12T13:10:52.598709Z) is not in that format. The first four characters are OK, but when it gets to the fifth character (index 4) the parser finds a hyphen, which it does not know what to do with.

Generally logstash will not allow you to set @timestamp to anything other than an object of type LogStash::Timestamp. If you try to set @timestamp to a string then it will throw an exception ("wrong argument type String (expected LogStash::Timestamp)").

I think both elasticsearch and kibana expect @timestamp to be a datetime, so it may cause problems downstream if you make it a string. Perhaps use a different field name to store this format?