Help to add new field from @timestamp

[florentmair (Florent)]

Hello,

i am not able to add new field, i want to date the hourofday value on a new field, but i have this error
I don't find into the documentation why it doesn't work

POST logstash-eno-2018.10_v2/_update_by_query
{      
  "query": {
    "bool": {
      "must_not": [
        {"exists": {
      "field": "eno_heure_utc"
      }}
      ]
    }
  },
  "script": {
    "source" : "ctx._source.eno_heure_utc = ctx._source['@timestamp'].value.hourOfDay",
    "lang": "painless"
    
  }
}

i have this error message :

{
  "error": {
    "root_cause": [
      {
        "type": "script_exception",
        "reason": "runtime error",
        "script_stack": [
          "ctx._source.eno_heure_utc = ctx._source['@timestamp'].value.hourOfDay",
          "                                                     ^---- HERE"
        ],
        "script": "ctx._source.eno_heure_utc = ctx._source['@timestamp'].value.hourOfDay",
        "lang": "painless"
      }
    ],
    "type": "script_exception",
    "reason": "runtime error",
    "script_stack": [
      "ctx._source.eno_heure_utc = ctx._source['@timestamp'].value.hourOfDay",
      "                                                     ^---- HERE"
    ],
    "script": "ctx._source.eno_heure_utc = ctx._source['@timestamp'].value.hourOfDay",
    "lang": "painless",
    "caused_by": {
      "type": "illegal_argument_exception",
      "reason": "Unable to find dynamic field [value] for class [java.lang.String]."
    }
  },
  "status": 500
} 

Thanks for help

[abdon (Abdon Pijpelink)]

If you get a date field from the _source it will be returned as a string. You need to parse that string into a date first, before you can get the hour of day. The following script should work:

ctx._source.eno_heure_utc =  OffsetDateTime.parse(ctx._source['@timestamp']).getHour()

[florentmair (Florent)]

thanks it works,

if someone needs for the number of Day of week

"source" : "ctx._source.eno_weekday = OffsetDateTime.parse(ctx._source['@timestamp']).DayOfWeek.getValue()"

it's not easy to find this information into the official documentation