# Aggregation using part of a timestamp field

**URL:** https://discuss.elastic.co/t/aggregation-using-part-of-a-timestamp-field/307858
**Category:** Kibana
**Created:** [June 22, 2022, 9:48am UTC](https://discuss.elastic.co/t/aggregation-using-part-of-a-timestamp-field/307858 "2022-06-22T09:48:36Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![mo-ezzat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mo-ezzat/32/107413_2.png) [@mo-ezzat](https://discuss.elastic.co/u/mo-ezzat)
#### Post date: [June 22, 2022, 9:48am UTC](https://discuss.elastic.co/t/aggregation-using-part-of-a-timestamp-field/307858/1 "2022-06-22T09:48:36Z")

</div>

Hello,  
I'm trying to make an aggregation using a field in the a timestamp format as

> "dateTimeReceived" : "2022-04-04T08:35:50.5566113Z"

but I just want to use the date part, so I tried using the visualization on kibana and sat the field as following  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/b/6b6c3adfe74e5236193e3f6d1a4b3cee3795de0c.png)  
and got that  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/c/fc112d094e3bd4c9632edec5dbc44e2a0ae76f50.png)

but I wanted to use date only and exclude the time, for example group all that took place in april 12 2022 together  
I tried the Date Histogram but what I got was totally wrong, for some reason all the date was converted into one

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/b/5b83fba17a96f44903a4fff8ad224b9ba0bc92c8.png)  
I tried different min intervals, but all the same

any help with that?  
thank you

---

<div class="post-metadata">

### Author: ![majagrubic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/majagrubic/32/74459_2.png) [@majagrubic](https://discuss.elastic.co/u/majagrubic)
#### Post date: [June 22, 2022, 11:46am UTC](https://discuss.elastic.co/t/aggregation-using-part-of-a-timestamp-field/307858/2 "2022-06-22T11:46:06Z")

</div>

Hi, I suggest you define a runtime field that would contain just the date (or month) portion of your timestamp. You can do that by going to `Data Views`, select your desired data view, click "Add Field" and then define a script for the new field value.  
Eg. to get the month, you would write something like this:  
`emit(doc['dateTimeReceived'].value.getMonthValue());`

Then you can use this field in aggregations as a regular field.

---

<div class="post-metadata">

### Author: ![mo-ezzat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mo-ezzat/32/107413_2.png) [@mo-ezzat](https://discuss.elastic.co/u/mo-ezzat)
#### Post date: [June 22, 2022, 3:40pm UTC](https://discuss.elastic.co/t/aggregation-using-part-of-a-timestamp-field/307858/3 "2022-06-22T15:40:33Z")

</div>

Thanks for your answer, I tried what you proposed and it worked fine  
I found value.toLocalDate() to get the entire date, but am having hard time finding a type for it

```auto
"runtime_mappings": {
"dateReceived": {
"type": ???,
 "script": {
 "source": "emit(doc['dateTimeReceived'].value.toLocalDate());"
 }

```

I've tried keyword, but it isn't acceptable, any idea about that?

> "class\_cast\_exception: Cannot cast java.time.LocalDate to java.lang.String"

thank you

---

<div class="post-metadata">

### Author: ![majagrubic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/majagrubic/32/74459_2.png) [@majagrubic](https://discuss.elastic.co/u/majagrubic)
#### Post date: [June 23, 2022, 7:37am UTC](https://discuss.elastic.co/t/aggregation-using-part-of-a-timestamp-field/307858/4 "2022-06-23T07:37:24Z")

</div>

You'll need to call `toString()` on it to make it a text field.

---

<div class="post-metadata">

### Author: ![mo-ezzat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mo-ezzat/32/107413_2.png) [@mo-ezzat](https://discuss.elastic.co/u/mo-ezzat)
#### Post date: [June 23, 2022, 7:53am UTC](https://discuss.elastic.co/t/aggregation-using-part-of-a-timestamp-field/307858/5 "2022-06-23T07:53:51Z")

</div>

Thanks a lot, that did it  
have a great day there

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 21, 2022, 7:54am UTC](https://discuss.elastic.co/t/aggregation-using-part-of-a-timestamp-field/307858/6 "2022-07-21T07:54:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
