Aggregate on timstamp part


I would like to make graphs on a specific part of @timestamp field.
Say, we want an average per hour over a certain period of time.

Is it possible to do that easily in Kibana?
Do we need a script field? If yes, how?

Is it necessary to preprocess this date field splitting in logstash to make it possible?

Bruno Lavoie

Just set the time buckets to hourly in the agg. But that wont work over (eg) years of data as the granularity is too small.

Oh, maybe I wasnt clear enough...

I want a bucket/aggregation by time part (day of week, hour).
So, if I select last year with an agregation on hour part of @timestamp, I will have 24 buckets (one for each hour).

The only way that I've found is to add a scripted field in kibana:


But I have questions regarding performance of this and where is it executed: in kibana or ES?
And, big drawback of this solution is that it's not timezone aware: extracted values are in UTC. Any way to convert it back to the client TZ?

Bruno Lavoie

So you want a bucket of 0000-0100 for all days in the year?

hum the buckets would be:

  • 00h00
  • 01h00
  • ...
  • 23h00

this can be for the year or last month or whatever the user select in time range in Kibana.