# Extract hour and weekday from custom date time field

**URL:** https://discuss.elastic.co/t/extract-hour-and-weekday-from-custom-date-time-field/237286
**Category:** Logstash
**Created:** [June 16, 2020, 11:47am UTC](https://discuss.elastic.co/t/extract-hour-and-weekday-from-custom-date-time-field/237286 "2020-06-16T11:47:53Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Rushabh\_Doshi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rushabh_doshi/32/69886_2.png) [@Rushabh\_Doshi](https://discuss.elastic.co/u/Rushabh_Doshi)
#### Post date: [June 16, 2020, 11:47am UTC](https://discuss.elastic.co/t/extract-hour-and-weekday-from-custom-date-time-field/237286/1 "2020-06-16T11:47:54Z")

</div>

for extracting hour and weekday from Activity-Time field the logstash snippet is as below:

date{

match =\> ["Activity-Time", "yyyy-MM-dd HH:mm:ss"]

target =\> "Activity-Time-New"

add\_field =\> {"hour" =\> "%{+HH}"}

add\_field =\> {"weekday" =\> "%{+EEE}"}

}

But by default it takes UTC time only @timestamp one , can you please guide what additional is required as i need to extract hour and weekday from Activity- Time, below is its format, and kibana snapshot i have attached

2020-06-03 03:30:50

 ![Screenshot 2020-06-16 at 12.16.03 PM](https://us1.discourse-cdn.com/elastic/original/3X/e/e/ee146830c3d10ada172543192ed60d5dd88aaddb.png)

---

<div class="post-metadata">

### Author: ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [June 16, 2020, 12:09pm UTC](https://discuss.elastic.co/t/extract-hour-and-weekday-from-custom-date-time-field/237286/2 "2020-06-16T12:09:50Z")

</div>

This might help:

> [@Strftime is not working Logshtash ruby code](https://discuss.elastic.co/t/strftime-is-not-working-logshtash-ruby-code/88008/3):
>
> The LogStash::Timestamp class has a time method. Try... ruby { code =\> "event.set('read\_time' , event.get('@timestamp').time.strftime('%Y-%m'))" }

and I think that you need to write `.time.localtime` if you don't want to use UTC for the hour and weekday, but your local timezone.

---

<div class="post-metadata">

### Author: ![Rushabh\_Doshi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rushabh_doshi/32/69886_2.png) [@Rushabh\_Doshi](https://discuss.elastic.co/u/Rushabh_Doshi)
#### Post date: [June 16, 2020, 1:55pm UTC](https://discuss.elastic.co/t/extract-hour-and-weekday-from-custom-date-time-field/237286/3 "2020-06-16T13:55:14Z")

</div>

@Jenni Please check the below code where i am doing wrong please guide

ruby {

code =\> "event.set('read\_time' , event.get('Activity-Time').time.localtime.strftime('%Y-%m-%d %H:%M:%S'))"

}

date{

#match =\> ["Activity-Time", "yyyy-MM-dd HH:mm:ss"]

#target =\> "Activity-Time-New"

add\_field =\> {"hour" =\> "%{+HH}"}

add\_field =\> {"weekday" =\> "%{+EEE}"}

}

I hope now there is no need of match and target row, please check if syntax is correct as it is still not working there is something wrong. Please guide

---

<div class="post-metadata">

### Author: ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [June 16, 2020, 4:10pm UTC](https://discuss.elastic.co/t/extract-hour-and-weekday-from-custom-date-time-field/237286/4 "2020-06-16T16:10:50Z")

</div>

What I meant it that you should use the Timestamp object (in the field `Activity-Time-New`) that you had already created with your date filter and then use `strftime` in ruby to create the two additional fields based on that instead of using `add_field => …`.

---

<div class="post-metadata">

### Author: ![Rushabh\_Doshi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rushabh_doshi/32/69886_2.png) [@Rushabh\_Doshi](https://discuss.elastic.co/u/Rushabh_Doshi)
#### Post date: [June 16, 2020, 6:54pm UTC](https://discuss.elastic.co/t/extract-hour-and-weekday-from-custom-date-time-field/237286/5 "2020-06-16T18:54:30Z")

</div>

@Jenni I tried the same but still i am getting UTC time and weekday, not the local one, please guide me where i am doing the mistake in code, please guide me syntax wise:

date{

match =\> ["Activity-Time", "yyyy-MM-dd HH:mm:ss"]

target =\> "Activity-Time-New"

}

ruby {

code =\> "event.set('read\_time' , event.get('Activity-Time-New').time.localtime.strftime('%Y-%m-%d %H:%M:%S'))"

add\_field =\> {"hour" =\> "%{+HH}"}

add\_field =\> {"weekday" =\> "%{+EEE}"}

}

---

<div class="post-metadata">

### Author: ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [June 17, 2020, 10:22am UTC](https://discuss.elastic.co/t/extract-hour-and-weekday-from-custom-date-time-field/237286/6 "2020-06-17T10:22:25Z")

</div>

I meant `…strftime('%a')` and `…strftime('%H')` so you could create the two fields with two lines of ruby code.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 15, 2020, 10:22am UTC](https://discuss.elastic.co/t/extract-hour-and-weekday-from-custom-date-time-field/237286/7 "2020-07-15T10:22:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
