# Extract Hour and Day from @timestamp
**URL:** https://discuss.elastic.co/t/extract-hour-and-day-from-timestamp/204542
**Category:** Logstash
**Created:** [October 21, 2019, 7:33pm UTC](https://discuss.elastic.co/t/extract-hour-and-day-from-timestamp/204542 "2019-10-21T19:33:09Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)
#### Post date: [October 21, 2019, 7:33pm UTC](https://discuss.elastic.co/t/extract-hour-and-day-from-timestamp/204542/1 "2019-10-21T19:33:09Z")
Hello!
I am trying to copy the day and hour from the timestamp field and add each to their own fields.
Here is my code:
```auto
if [source] =~ "tableBASEtest" {
mutate{ add_field => {
"[@metadata][timestamp]" => "%{SMF30DTE} %{SMF30TME}"
}}
date{ match => [
"[@metadata][timestamp]", "yyyy-MM-dd HH:mm:ss:SS"
]}
mutate {
add_field => {"hour" => "%{+HH}"}
add_field => {"day" => "%{+EEE}"}
}
}
```
For some reason, when this runs, no new fields are created. And sometimes kibana defaults to an old index from a previous configuration (no clue as to what would cause that).
Also,
I've tried this as well:
```auto
if [source] =~ "tableBASEtest" {
mutate{ add_field => {
"[@metadata][timestamp]" => "%{SMF30DTE} %{SMF30TME}"
}}
date{ match => [
"[@metadata][timestamp]", "yyyy-MM-dd HH:mm:ss:SS"
]}
ruby{
code => "event.set('[day_of_week]',event.get('@timestamp').time.strftime '%a')"
}
}
```
This just errors out with:
```auto
[2019-10-21T18:58:28,368][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SyntaxError) (ruby filter code):2: syntax error, unexpected tSTRING_BEG
event.set('day_of_week',event.get('@timestamp').time.strftime '%a')
```
Any help would be awesome.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 21, 2019, 7:44pm UTC](https://discuss.elastic.co/t/extract-hour-and-day-from-timestamp/204542/2 "2019-10-21T19:44:20Z")
> [@Jim\_Thunder](#):
>
> unexpected tSTRING\_BEG
> event.set('day\_of\_week',event.get('@timestamp').time.strftime '%a')
I believe you would need parentheses around the '%a'
---
### Author:  [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)
#### Post date: [October 21, 2019, 8:52pm UTC](https://discuss.elastic.co/t/extract-hour-and-day-from-timestamp/204542/3 "2019-10-21T20:52:19Z")
Did not work. I get a syntax error.
I got that code from this page. Some guy said that worked for him... I don't know how though?
Also how did you get my code above to be in the green/gray box? I couldn't figure that out.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 21, 2019, 10:33pm UTC](https://discuss.elastic.co/t/extract-hour-and-day-from-timestamp/204542/4 "2019-10-21T22:33:36Z")
```
ruby { code => "event.set('[day_of_week]',event.get('@timestamp').time.strftime('%a'))" }
```
gets me
```
"day_of_week" => "Mon"
```
What synxtax error do you get?
You can format posts using markdown. In particular [code and syntax highlighting](https://github.com/adam-p/markdown-here/wiki/Markdown-Cheatsheet#code-and-syntax-highlighting). The \ button in the toolbar above the edit panel will indent your code by four spaces for you.
---
### Author:  [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)
#### Post date: [October 22, 2019, 2:38pm UTC](https://discuss.elastic.co/t/extract-hour-and-day-from-timestamp/204542/5 "2019-10-22T14:38:08Z")
Ok I'm working on it right now. I tried your code snippet. If it works on your end it should work for me. However, once I update the code, for some reason when I choose an index in Kibana it gives me an index from Oct. 15th and NOT from today. Any idea what would cause that bit?
I'll let you know if I get it working and if the codes works. Should be real soon.
---
### Author:  [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)
#### Post date: [October 22, 2019, 2:53pm UTC](https://discuss.elastic.co/t/extract-hour-and-day-from-timestamp/204542/6 "2019-10-22T14:53:33Z")
I think it worked... my docker is messed up but I'm trying the code in a test environment. Thank you! Do you know what the syntax would be for 'hour'? I'm not sure why an 'a' is used for day of the week. I would expect 'dd' for day and 'HH' for hour.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 22, 2019, 3:38pm UTC](https://discuss.elastic.co/t/extract-hour-and-day-from-timestamp/204542/7 "2019-10-22T15:38:46Z")
[strftime](https://www.rubydoc.info/stdlib/core/Time:strftime) uses %H for hour.
---
### Author:  [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)
#### Post date: [October 22, 2019, 7:04pm UTC](https://discuss.elastic.co/t/extract-hour-and-day-from-timestamp/204542/8 "2019-10-22T19:04:13Z")
awesome. And I just saw the code you provided worked in the test environment. Thank you!
Got "Tue" in the "day\_of\_week" field.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 19, 2019, 7:04pm UTC](https://discuss.elastic.co/t/extract-hour-and-day-from-timestamp/204542/9 "2019-11-19T19:04:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.