# Get year, month and date when not specified on log

**URL:** https://discuss.elastic.co/t/get-year-month-and-date-when-not-specified-on-log/174195
**Category:** Logstash
**Created:** [March 27, 2019, 8:03pm UTC](https://discuss.elastic.co/t/get-year-month-and-date-when-not-specified-on-log/174195 "2019-03-27T20:03:31Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![pbressan13](https://avatars.discourse-cdn.com/v4/letter/p/cab0a1/32.png) [@pbressan13](https://discuss.elastic.co/u/pbressan13)
#### Post date: [March 27, 2019, 8:03pm UTC](https://discuss.elastic.co/t/get-year-month-and-date-when-not-specified-on-log/174195/1 "2019-03-27T20:03:31Z")

</div>

Hi,

I'm facing with a particular issue, I'm trying to find the best and accurate way to set year/month/day to my input document

My input log only prints hour:minute:second, like example above:

16:00:00,840 blablabla...

And when my log closes from past hour, it changes its name  
from =\> .log  
to =\> .log\_YYYY-MM-DD-HH

So in this case, i used a ruby code to get year, month and day, and used to concatenate with event "logtime" which is hour, minute and second from log hour

```
    ruby {
        code => "
            event.set('timestamp', [event.get('source').split('/')[-1].split('_')[-1][0..9], event.get('logTime').split(',')[0]].join(' '))
        "
    }

```

However, when log is current i don't have this information from source field (name of file), so i thought using current timestamp (YYYY-MM-DD) to concatenate from logTime field (hour from my logfile)

However, this may cause a wrong data information, for example, if input comes on hour 23:59:59, i may use current day (which is already next day) and input data from future and loses integrity from my base.

I checked on a lot of links, and my issue seems to be the same of this link (for me, i need something like nearest default) as described on this git issue

> <https://github.com/logstash-plugins/logstash-filter-date/issues/51>

Does anybody knows how to workaround this?

Thanks!

---

<div class="post-metadata">

### Author: ![pbressan13](https://avatars.discourse-cdn.com/v4/letter/p/cab0a1/32.png) [@pbressan13](https://discuss.elastic.co/u/pbressan13)
#### Post date: [April 16, 2019, 2:49pm UTC](https://discuss.elastic.co/t/get-year-month-and-date-when-not-specified-on-log/174195/2 "2019-04-16T14:49:23Z")

</div>

Hi everyone,

I solved my issue using a ruby code (not so clean, but it's working ok)

```
    ruby {
        code => "
                event_hour = event.get('logTime').split(':')[0].to_i
                current_hour = Time.now.strftime('%H').to_i
                if current_hour < event_hour
                        event.set('timestamp', (Time.now - 86400).strftime('%Y-%m-%d') + ' ' + event.get('logTime'))
                else
                        event.set('timestamp', Time.now.strftime('%Y-%m-%d') + ' ' + event.get('logTime'))
                end
        "
    }
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 14, 2019, 2:49pm UTC](https://discuss.elastic.co/t/get-year-month-and-date-when-not-specified-on-log/174195/3 "2019-05-14T14:49:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.