# Extracting time from @timestamp field using Runtime

**URL:** <https://discuss.elastic.co/t/extracting-time-from-timestamp-field-using-runtime/348468>\
**Category:** Kibana\
**Tags:** runtime\
**Created:** [December 2, 2023, 7:53am UTC](https://discuss.elastic.co/t/extracting-time-from-timestamp-field-using-runtime/348468 "2023-12-02T07:53:37Z")\
**Posts on this page:** 1\
**Showing post:** 11

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 4, 2023, 4:52am UTC](https://discuss.elastic.co/t/extracting-time-from-timestamp-field-using-runtime/348468/11 "2023-12-04T04:52:14Z")

</div>

> [@Ethan777100](#):
>
> It will extract the `hh:mm:ss.xxx` component from `@timestamp` and translate to the new column `@time_of_day`
> 
> But yet in the raw csv files, the `@time_of_day` column will not exist.

Add the mapping to the template and a `script` process to the ingest pipeline... and you do not need the `@` for every timestamp / date that is just and nameing convtion for the special field `@timestamp`

take a look at this...

```auto
POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "script": {
          "lang": "painless",
          "source": """ZonedDateTime zdt = ZonedDateTime.parse(ctx['@timestamp'], DateTimeFormatter.ISO_ZONED_DATE_TIME);
          String time_of_day = zdt.format(DateTimeFormatter.ISO_LOCAL_TIME);
          ctx['time_of_day'] = time_of_day;
          """
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "@timestamp": "2023-12-04T03:55:39.219Z"
      }
    }
  ]
}

# result

{
  "docs": [
    {
      "doc": {
        "_index": "_index",
        "_version": "-3",
        "_id": "_id",
        "_source": {
          "time_of_day": "03:55:39.219",
          "@timestamp": "2023-12-04T03:55:39.219Z"
        },
        "_ingest": {
          "timestamp": "2023-12-04T04:50:52.377145525Z"
        }
      }
    }
  ]
}

```

---

_[View the full topic](https://discuss.elastic.co/t/extracting-time-from-timestamp-field-using-runtime/348468)._