Hour Extraction

[Jim_Thunder]

Hello!

I am trying to extract the hour from the timestamp using a scripted field. I haven't a clue how. Any thoughts?

The reason I need to do it in a scripted field is because of the timezone change. When I pull the hour out in logstash I get UTC time and not Amercia/Chicago.

[spinscale (Alexander Reelsen)]

on top of my head

doc['timestamp_field'].value.getHour()

however this hour will be in UTC as well, as it is accessing the value stored in kibana. Not sure about your use-case. Maybe it is sufficient to configure the timezone in kibana?

[Jim_Thunder]

The code worked but you're right, still UTC. How can I get the hour from the Time that the Kibana got the record?

[spinscale (Alexander Reelsen)]

you could retrieve the zoneoffset. The object being returned is a JodaCompatibleZonedDateTime, see https://www.elastic.co/guide/en/elasticsearch/painless/7.4/painless-api-reference-shared-org-elasticsearch-script.html#painless-api-reference-shared-JodaCompatibleZonedDateTime

--Alex

[Jim_Thunder]

I already have a zone offset (I think?) It comes out to -5 hours.

Something else I did find though: Kibana auto detects dates/times and THAT is what my underlying problem is. Do you know how I can tell kibana to NOT auto detect times/dates and just write to each field as a string?

I want that "TYPE" for SMF30DTE to be a string NOT a date (note: I manually changed the Format to string, was blank before).

[spinscale (Alexander Reelsen)]

indeed, you can format fields in kibana, see https://www.elastic.co/guide/en/kibana/7.4/managing-fields.html