# Best way to truncate a date field?

**URL:** <https://discuss.elastic.co/t/best-way-to-truncate-a-date-field/37507>\
**Category:** Logstash\
**Created:** [December 17, 2015, 8:01pm UTC](https://discuss.elastic.co/t/best-way-to-truncate-a-date-field/37507 "2015-12-17T20:01:57Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![CraigFoote](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craigfoote/32/4571_2.png) [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\
**Post date:** [December 17, 2015, 8:01pm UTC](https://discuss.elastic.co/t/best-way-to-truncate-a-date-field/37507/1 "2015-12-17T20:01:57Z")

</div>

I'm ingesting old logs and want to use a data field value in the index name:

```
elasticsearch{
    index => "logstash-systemname-%{day}"
    ...
}

```

It's a LogStash::TimeStamp field but I want to copy it and truncate the copy to day precision.

So which is better?

#1

```
ruby{
    code => "
        event['day'] = event['log_timestamp'];
        event['day'] = event.sprintf('%{+YYYY-MM-dd}');
    "
}

```

[note that #1 has failed for me on occasion, not sure why]

#2

```
ruby{
    code => "
        event['day'] = Time.parse(event['log_timestamp'].to_s).strftime('%Y-%m-%d');
    "
}

```

Or is there a better, third option?

---

<div class="post-metadata">

**Author:** ![wiibaa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wiibaa/32/44931_2.png) [@wiibaa](https://discuss.elastic.co/u/wiibaa)\
**Post date:** [December 18, 2015, 5:08am UTC](https://discuss.elastic.co/t/best-way-to-truncate-a-date-field/37507/2 "2015-12-18T05:08:11Z")

</div>

Beware that in your #1 case you are using the **@timestamp** field when doing **event.sprintf('%{+YYYY-MM-dd}')** and not your log\_timestamp.

Is it out of the question to simply change the `@timestamp` value and that's why you are not using the date filter ?

```
filter {
  date {
    #please use the correct pattern(s)
    match => ['log_timestamp, 'yyyy-MM-dd HH:mm:ss']
    add_field => { 'day => '%{+YYYY-MM-dd}' }
  }
}
```

---

<div class="post-metadata">

**Author:** ![CraigFoote](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craigfoote/32/4571_2.png) [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\
**Post date:** [December 18, 2015, 3:13pm UTC](https://discuss.elastic.co/t/best-way-to-truncate-a-date-field/37507/3 "2015-12-18T15:13:19Z")

</div>

> Beware that in your #1 case you are using the @timestamp field when doing event.sprintf('%{+YYYY-MM-dd}') and not your log\_timestamp.

That explains the odd behaviour I was seeing sometimes, thanks.

I am actually using the date filter to "reset" the @timestamp for the event to the datetime in the event's log\_timestamp field. I just omitted that code.

But I want only the day portion in the index name. Not sure how I would use the date filter to do that.

---

<div class="post-metadata">

**Author:** ![CraigFoote](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craigfoote/32/4571_2.png) [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\
**Post date:** [December 18, 2015, 3:35pm UTC](https://discuss.elastic.co/t/best-way-to-truncate-a-date-field/37507/4 "2015-12-18T15:35:48Z")

</div>

I really should finish reading the post before replying ☹ I just saw your date filter snippet and I'll give it a try, thanks.

---

<div class="post-metadata">

**Author:** ![CraigFoote](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craigfoote/32/4571_2.png) [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\
**Post date:** [December 18, 2015, 3:47pm UTC](https://discuss.elastic.co/t/best-way-to-truncate-a-date-field/37507/5 "2015-12-18T15:47:40Z")

</div>

Thanks @wiibaa, that worked and is much cleaner than ruby code.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:17am UTC](https://discuss.elastic.co/t/best-way-to-truncate-a-date-field/37507/6 "2017-07-06T05:17:51Z")

</div>