# How to Parse and Copy a Field

**URL:** <https://discuss.elastic.co/t/how-to-parse-and-copy-a-field/113918>\
**Category:** Logstash\
**Created:** [January 3, 2018, 12:35pm UTC](https://discuss.elastic.co/t/how-to-parse-and-copy-a-field/113918 "2018-01-03T12:35:48Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![MultiplierMultiplier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/multipliermultiplier/32/25063_2.png) [@MultiplierMultiplier](https://discuss.elastic.co/u/MultiplierMultiplier)\
**Post date:** [January 3, 2018, 12:35pm UTC](https://discuss.elastic.co/t/how-to-parse-and-copy-a-field/113918/1 "2018-01-03T12:35:48Z")

</div>

I have the TimeStamp field and I would like to extract the hour of the day so that I can look for out of hours user activity.

> Jan 3 12:09:01
> 
> filter {  
> grok {  
> match =\> { "TimeStamp" =\> "%{WORD}\s%{NUMBER}\s%{NUMBER:HourOfDay}:%{NUMBER}:%{NUMBER}" }  
> }  
> }

At the top you can see an example of TimeStamp and below is how I would go about parsing it. I would like to however on parse the hour of the day into the new field HourOfDay and then keep the TimeStamp field as is.

Would this grok config work?

Cheers,

G

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 3, 2018, 7:13pm UTC](https://discuss.elastic.co/t/how-to-parse-and-copy-a-field/113918/2 "2018-01-03T19:13:34Z")

</div>

> Would this grok config work?

Why not try it out? It looks okay but you'll probably want `%{NUMBER:HourOfDay:int}` to make the field an integer.

---

<div class="post-metadata">

**Author:** ![MultiplierMultiplier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/multipliermultiplier/32/25063_2.png) [@MultiplierMultiplier](https://discuss.elastic.co/u/MultiplierMultiplier)\
**Post date:** [January 5, 2018, 12:39pm UTC](https://discuss.elastic.co/t/how-to-parse-and-copy-a-field/113918/3 "2018-01-05T12:39:04Z")

</div>

Hi @magnusbaeck I tried changing my config to the above and restarted Logstash, upon restarting my whole VM locked up and I had to restart the entire thing! Logstash didn't write to any of the logs (it's set to debug mode) and I had to just remove the grok pattern.

I'm unsure where to go from here.

Cheers,

G

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 5, 2018, 9:17pm UTC](https://discuss.elastic.co/t/how-to-parse-and-copy-a-field/113918/4 "2018-01-05T21:17:40Z")

</div>

I find it very hard to believe that that configuration change crashed the whole VM.

---

<div class="post-metadata">

**Author:** ![MultiplierMultiplier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/multipliermultiplier/32/25063_2.png) [@MultiplierMultiplier](https://discuss.elastic.co/u/MultiplierMultiplier)\
**Post date:** [January 8, 2018, 9:14am UTC](https://discuss.elastic.co/t/how-to-parse-and-copy-a-field/113918/5 "2018-01-08T09:14:46Z")

</div>

Hi there @magnusbaeck I think I found out why the VM crashed. Logsash log level was set to DEBUG, once I got back into the VM (as Logstash doesn't automatically start when the VM does) I found there to be around 15GB of log files created by Logstash. I will set the log level to normal and retry the grok.

Cheers,

G

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 5, 2018, 9:14am UTC](https://discuss.elastic.co/t/how-to-parse-and-copy-a-field/113918/6 "2018-02-05T09:14:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.