# How to convert @timestamp value to yyyyMM in logstash pipeline

**URL:** <https://discuss.elastic.co/t/how-to-convert-timestamp-value-to-yyyymm-in-logstash-pipeline/370408>\
**Category:** Logstash\
**Created:** [November 12, 2024, 2:32pm UTC](https://discuss.elastic.co/t/how-to-convert-timestamp-value-to-yyyymm-in-logstash-pipeline/370408 "2024-11-12T14:32:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![zadkiel\_meta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zadkiel_meta/32/139144_2.png) [@zadkiel\_meta](https://discuss.elastic.co/u/zadkiel_meta)\
**Post date:** [November 12, 2024, 2:32pm UTC](https://discuss.elastic.co/t/how-to-convert-timestamp-value-to-yyyymm-in-logstash-pipeline/370408/1 "2024-11-12T14:32:59Z")

</div>

I am very new joiner in logstash pipeline:

I want to indexed @timestamp value format as yyyyMM, example "202411"

Incomming BillingMonth value ="202411"

Logstash Pipeline:  
filter {  
event.set("@timestamp", event.get("BillingMonth"))  
}

Index Mapping:  
{  
"mappings": {  
"properties": {  
"@timestamp": {  
"type": "date",  
"format": "yyyyMM"  
},  
...  
}

but anyway , I alway get logstash error like

```auto
"caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"failed to parse date field [2024-11-12T13:10:52.598709Z] with format [yyyyMM]", "caused_by"=>{"type"=>"date_time_parse_exception", "reason"=>"Text '2024-11-12T13:10:52.598709Z' could not be parsed at index 4"}

```

How can I solve it?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 12, 2024, 3:39pm UTC](https://discuss.elastic.co/t/how-to-convert-timestamp-value-to-yyyymm-in-logstash-pipeline/370408/2 "2024-11-12T15:39:17Z")

</div>

> [@zadkiel\_meta](#):
>
> `"reason"=>"failed to parse date field [2024-11-12T13:10:52.598709Z] with format [yyyyMM]", "caused_by"=>{"type"=>"date_time_parse_exception", "reason"=>"Text '2024-11-12T13:10:52.598709Z' could not be parsed at index 4"}`

Your mapping says @timestamp should be in the format yyyyMM, but the text that you sent (`2024-11-12T13:10:52.598709Z`) is not in that format. The first four characters are OK, but when it gets to the fifth character (index 4) the parser finds a hyphen, which it does not know what to do with.

Generally logstash will not allow you to set @timestamp to anything other than an object of type LogStash::Timestamp. If you try to set @timestamp to a string then it will throw an exception ("wrong argument type String (expected LogStash::Timestamp)").

I think both elasticsearch and kibana expect @timestamp to be a datetime, so it may cause problems downstream if you make it a string. Perhaps use a different field name to store this format?