# How to modify a single value from timestamp
**URL:** https://discuss.elastic.co/t/how-to-modify-a-single-value-from-timestamp/285567
**Category:** Logstash
**Created:** [September 30, 2021, 9:30am UTC](https://discuss.elastic.co/t/how-to-modify-a-single-value-from-timestamp/285567 "2021-09-30T09:30:23Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Jose\_E](https://discuss.elastic.co/u/Jose_E)
#### Post date: [September 30, 2021, 9:30am UTC](https://discuss.elastic.co/t/how-to-modify-a-single-value-from-timestamp/285567/1 "2021-09-30T09:30:23Z")
Hi all,
I'm trying to find out a way to substitute a single value from @timestamp, from another one, for instance, the hour.
So far I know you can get the timestamp separated values using `%{+HH}`, but I can't find a way to do something like:
`mutate { replate => { '+HH' => '%{fake_hour_value}' } }`
Can you guys help me? I just need to substitute the '@timestamp' hour for another value. This also raises the following question, would it be necessary to use the **date** filter plugin after, or would Elasticsearch be able to process the new @timestamp as such?
Thanks in advance.
---
### Author:  [@Jose\_E](https://discuss.elastic.co/u/Jose_E)
#### Post date: [September 30, 2021, 9:45am UTC](https://discuss.elastic.co/t/how-to-modify-a-single-value-from-timestamp/285567/2 "2021-09-30T09:45:07Z")
I forgot to mention I have a way of doing this already, but is far from what I consider ideal:
```auto
mutate {
add_field => { "ts_minute" => "%{+mm}" }
add_field => { "ts_second" => "%{+ss}" }
add_field => { "ts_millisecond" => "%{+SSS}" }
add_field => { "ts_year" => "%{+yyyy}" }
add_field => { "ts_month" => "%{+MM}" }
add_field => { "ts_day" => "%{+dd}" }
}
mutate { add_field => { "timestamp2" => "%{ts_year}-%{ts_month}-%{ts_day}T%{ingested_hour}:%{ts_minute}:%{ts_second}.%{ts_millisecond}Z" } }
date {
timezone => "UTC"
match => [
"timestamp2",
"ISO8601"
]
}
```
The `ingested_hour` is obtained previously, in case you are wondering. This does work for me, but I would like to know if there's a more sophisticated approach.
Thanks.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 30, 2021, 2:37pm UTC](https://discuss.elastic.co/t/how-to-modify-a-single-value-from-timestamp/285567/3 "2021-09-30T14:37:33Z")
You could use mutate+gsub. Something like
```
mutate { add_field => { "timestamp2" => "%{@timestamp}" } }
mutate { convert => { "timestamp2" => "string" } }
mutate { gsub => ["timestamp2", "(\d(4)-\d{2}-\d{2}T)\d{2}(:\d(2):\d{2}.\d{3}Z)", "\1%{ingested_hour}\2"] }
```
Not sure if that counts as more sophisticated though.
---
### Author:  [@Jose\_E](https://discuss.elastic.co/u/Jose_E)
#### Post date: [September 30, 2021, 3:08pm UTC](https://discuss.elastic.co/t/how-to-modify-a-single-value-from-timestamp/285567/4 "2021-09-30T15:08:13Z")
Thanks, that works as sophisticated for me since I can't do regex 😅 It works perfectly, thank you!!!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 28, 2021, 3:08pm UTC](https://discuss.elastic.co/t/how-to-modify-a-single-value-from-timestamp/285567/5 "2021-10-28T15:08:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.