Add +1 day to Datefield Kibana scripted fields

[Datakids (Thorben)]

Hi there,
I wonder how to add a Day to existing Date field.

For example:

Left Date is Original and I need on right hand the origin date + 1 Day

Type: Date
Format: Date

I tried:
doc['Datum'].value + ("1d")
doc['Datum'].value + ("24:00:00") etc

but this way not work.

How can I do that in scripted fields?

Thanks in advance for your help

Regards

[aaron-nimocks]

I did this in the Painless Lab but should still work.

String datetime = '1983-10-13T22:15:30Z';
ZonedDateTime zdt = ZonedDateTime.parse(datetime); 

ZonedDateTime updatedZdt = zdt.plusDays(1);

return updatedZdt;

References:
Using Datetime in Painless

[Datakids (Thorben)]

Hi Aaron,
thanks for your prompt answer

yes your snipet for this particular date string works, even in kibana 7.3.0
but how to access the Datum field itself?

I add a scripted field "Datum+1" (Type String, Format String): from doc['Datum'].value
And add this new field to your snipet but wont work (even if i use the date field)

String datetime = doc['Datum+1'].value;
ZonedDateTime zdt = ZonedDateTime.parse(datetime);
ZonedDateTime updatedZdt = zdt.plusDays(1);
return updatedZdt;

Any Idea

[aaron-nimocks]

In scripted fields I just test this on 7.10. Let me know if it doesn't work in your version.

Just replace @timestamp with your field name which I think is Datum.

ZonedDateTime origValue = doc['@timestamp'].value;
ZonedDateTime newValue = origValue.plusDays(1);

return newValue;

You don't set Datum+1 to anything. The return value is the new value of the name of the scripted field. Also I would avoid using special characters in that name.

[Datakids (Thorben)]

hm, not working
origValue and newValue ist not recognize by script language (or meant its not "blue")

if I change newValue to just new it change the color to blue
but what is the right param for origValue ?

[aaron-nimocks]

Here is what I have.

When clicking on Get help with the syntax and preview the results of your script. at the bottom this is what I am showing.

If there are errors in the script this is where they would show them. What does yours say?

[Datakids (Thorben)]

here my error snipet:

[aaron-nimocks]

Can you put in your query that generates this error also?

Also what does your Datum field look like? Can you paste an example.

You might need to use JodaCompatibleZonedDateTime vs ZonedDateTime according to that error.

[Datakids (Thorben)]

I didn't think it was that complicated to manage a simple + of whatever value to a date field.

Ok, here is my Logstash mapping:

date {
	match => ["Datum", "YYYY-MM-dd"]
	target => "Datum"
}

For Datefield comming from file with this format: 2020-12-14

Thats it, no magic in the middle !

I tried a few things like below to become more familar.
This here works for instance:

long timestampLog = doc['Datum'].value.toInstant().toEpochMilli();
long timestampNew = timestampLog;
return timestampNew;

But no any addDays or plusDays works!?

Thanks again for any suggestion

[Datakids (Thorben)]

so for whatever reason +1 on my timefield doesnt work.
So I managed this by reindex and add a mutate timezone field +1

Thanks anyway for your help