Basic Math in Logstash

[Jim_Thunder]

All I want to do it subtract 6 from the "hour_of_day" field, because it's six hours ahead. Which from my understanding, it shouldn't be ahead b/c I used ruby. But whatever the case, it's wrong.

Here's my code:

ruby {
		code => "event.set('[hour_of_day]',(event.get('@timestamp').time.strftime('%H') - 6))"
	}

I get error messages on the - b/c it (ruby?) doesn't know what - is.

How can I fix that?

Much appreciated!

[Badger]

strftime returns a string. You are effectively trying to do

"12" - 6

It will not coerce "12" into 12, so you need to use .to_i

ruby { code => "event.set('[hour_of_day]', (event.get('@timestamp').time.strftime('%H').to_i - 6))" }

How is @timestamp getting set? If it is set by a date filter then you can use the timezone option to adjust the hour.

[Jim_Thunder]

That worked. Got my time set to the correct hour.

But yea I use a date filter to set @timestamp. I didn't know I could change the timezone!
Point me in the right direction for that?

[Badger]

Use the timezone option. Something like

date {
    match => [ ... ]
    timezone => "Etc/GMT-6"
}