Classifying records into quarters based on timestamps

I have records that I would like to classify into quarters based on the timestamp value.
The logic I am shooting for is:

If the month of the timestamp is 1, 2, or 3 then add_field { "Quarter" => "Q1"}
If the month of the timestamp is 4,5 or 6 then add_field { "Quarter" => "Q2"}
and so on.

How do I compare only the month value of my timestamp to make this if-else clause?


The following would work. Not convinced it is the best way though :slight_smile:

    ruby {
        code => '
            epochMS = (event.get("@timestamp").to_f * 1000).to_s
            monthNum = DateTime.strptime(epochMS, "%Q").month
            quarter = (monthNum.to_f / 3).ceil
            event.set("Quarter", "Q#{quarter}")

Thanks Badger!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.