# Extract day, month and year from a date field. Changing Timezone

**URL:** <https://discuss.elastic.co/t/extract-day-month-and-year-from-a-date-field-changing-timezone/267646>\
**Category:** Logstash\
**Created:** [March 18, 2021, 11:38am UTC](https://discuss.elastic.co/t/extract-day-month-and-year-from-a-date-field-changing-timezone/267646 "2021-03-18T11:38:17Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ernesto\_Guerra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ernesto_guerra/32/77872_2.png) [@Ernesto\_Guerra](https://discuss.elastic.co/u/Ernesto_Guerra)\
**Post date:** [March 18, 2021, 11:38am UTC](https://discuss.elastic.co/t/extract-day-month-and-year-from-a-date-field-changing-timezone/267646/1 "2021-03-18T11:38:17Z")

</div>

Hi, I would like to add some fields extracting data from "[layers][frame][frame\_frame\_time]" field. My code is:

```auto
date {
      match => ["[layers][frame][frame_frame_time]","ISO8601" ]
      target => "[layers][frame][frame_frame_time]"
      
      #2021-02-20T03:32:31.413001000Z

      timezone => "Europe/Madrid"
      add_field => {"mes" => "%{+MM}" }
      add_field => {"dia" => "%{+dd}" }
      add_field => {"ano" => "%{+YYYY}" }
      add_field => {"hora" => "%{+HH}" }
    }

```

The result is that I get the Month, day, year and hour of the "timestamp" field instead of the one that I want to.

 ![2021-03-18_12-31-36](https://us1.discourse-cdn.com/elastic/original/3X/8/a/8a076fd8b56a34c39d8127f09179c8d89b4c1100.png)

In addition to that, I can not get the hour to match the one in the field, even changing the timezone.

Thanks in advance for your help.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 18, 2021, 5:27pm UTC](https://discuss.elastic.co/t/extract-day-month-and-year-from-a-date-field-changing-timezone/267646/2 "2021-03-18T17:27:44Z")

</div>

logstash and elasticsearch always store timestamps as UTC. sprintf references will always be in UTC. If you want the sprintf references to be in another timezone you will have to lie to logstash about what timezone [@timestamp] is in. (And note that sprintf references use [@timestamp], not whatever field the date filter is using.)

---

<div class="post-metadata">

**Author:** ![Ernesto\_Guerra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ernesto_guerra/32/77872_2.png) [@Ernesto\_Guerra](https://discuss.elastic.co/u/Ernesto_Guerra)\
**Post date:** [March 22, 2021, 4:47pm UTC](https://discuss.elastic.co/t/extract-day-month-and-year-from-a-date-field-changing-timezone/267646/3 "2021-03-22T16:47:23Z")

</div>

> [@Badger](#):
>
> sprintf references

Thanks for the answer. Any idea how could I extract that same data from  
[layers][frame][frame\_frame\_time] field?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 22, 2021, 4:50pm UTC](https://discuss.elastic.co/t/extract-day-month-and-year-from-a-date-field-changing-timezone/267646/4 "2021-03-22T16:50:54Z")

</div>

> [@Ernesto\_Guerra](#):
>
> Any idea how could I extract that same data from  
> [layers][frame][frame\_frame\_time] field?

Use a ruby filter and [strftime](https://discuss.elastic.co/t/date-field-being-converted-to-timestamps/180044/4).

---

<div class="post-metadata">

**Author:** ![Ernesto\_Guerra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ernesto_guerra/32/77872_2.png) [@Ernesto\_Guerra](https://discuss.elastic.co/u/Ernesto_Guerra)\
**Post date:** [March 24, 2021, 11:30am UTC](https://discuss.elastic.co/t/extract-day-month-and-year-from-a-date-field-changing-timezone/267646/5 "2021-03-24T11:30:50Z")

</div>

I tried the solution in the referenced post and worked perfectly. Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 21, 2021, 11:31am UTC](https://discuss.elastic.co/t/extract-day-month-and-year-from-a-date-field-changing-timezone/267646/6 "2021-04-21T11:31:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.