# Adding 1 day to the date

**URL:** https://discuss.elastic.co/t/adding-1-day-to-the-date/129168
**Category:** Logstash
**Created:** [April 23, 2018, 7:24pm UTC](https://discuss.elastic.co/t/adding-1-day-to-the-date/129168 "2018-04-23T19:24:53Z")
**Posts on this page:** 1
**Showing post:** 17

<div class="post-metadata">

### Author: ![HRG](https://avatars.discourse-cdn.com/v4/letter/h/a4c791/32.png) [@HRG](https://discuss.elastic.co/u/HRG)
#### Post date: [April 25, 2018, 2:27pm UTC](https://discuss.elastic.co/t/adding-1-day-to-the-date/129168/17 "2018-04-25T14:27:23Z")

</div>

Please see below

#Extract Business date from file

```
grok {
	match => ["file", "%{WORD}.%{WORD:BusinessDate}.%{GREEDYDATA:FileLastPart}"]		
}      

if "_grokparsefailure" in [tags] {		
	mutate {				
			remove_tag => ["_grokparsefailure"]		
	}				
}

#Parse Business date
	
grok {
	match => ["BusinessDate", "%{YEAR:year}%{MONTHNUM:month}%{MONTHDAY:day}"]
}      

if "_grokparsefailure" in [tags] {		
	mutate {				
			remove_tag => ["_grokparsefailure"]					
	}				
}

# Set Timestamp

mutate {
	add_field => {
		ExpectedTime => "03:00:00.000"
	}
}

mutate {
	add_field => {
		BusinesDateTime => "%{year}-%{month}-%{day} %{ExpectedTime}"
	}
}
#Not required ExptectedTime in output
mutate {
	remove_field => [ExpectedTime]
}

#Convert to Date
date
{
	match => ["BusinesDateTime", "YYYY-MM-DD HH:mm:ss.SSS"]		
	target => "BusinesDateTime"
}

#Adding one day to BusinessDateTime

ruby {
	code => 'event.set("BusinesDateTimeConverted", LogStash::Timestamp.new(Time.at(event.get("BusinesDateTime").to_f+86400)))'				
}
	
#Remove Milliseconds	
mutate {
	gsub => ["LogEventTimeStamp", "\.\d{3}$", ""]
}

#Setting up Log timestamp to LogEventTimeStamp for the given formats.
date
{
	match => ["BusinesDateTimeConverted", "yyyy-MM-dd HH:mm:ss", "MMM dd, yyyy HH:mm:ss", "yyyy-MM-dd HH:mm:ss,SSS", "yyyy-MM-dd HH:mm:ss.SSS"]		
	target => "BusinesDateTimeConverted"		
}

#Setting up Log timestamp to LogEventTimeStamp for the given formats.
date
{
	match => ["LogEventTimeStamp", "yyyy-MM-dd HH:mm:ss", "MMM dd, yyyy HH:mm:ss", "yyyy-MM-dd HH:mm:ss,SSS", "yyyy-MM-dd HH:mm:ss.SSS"]		
	target => "LogEventTimeStamp"		
}

```

#Date comparision  
date  
{  
if "LogEventTimeStamp \>= "BusinesDateTimeConverted" {  
mutate {  
add\_field =\> {  
"LateFileStatus" =\> "LateArrival"  
}   
}   
} else {  
mutate {  
add\_field =\> {  
"LateFileStatus" =\> "On-Time"  
}   
}   
}   
}  
#End of Date Comparision

---

_[View the full topic](https://discuss.elastic.co/t/adding-1-day-to-the-date/129168)._