# Logstash grok hour and minute ruby
**URL:** https://discuss.elastic.co/t/logstash-grok-hour-and-minute-ruby/259724
**Category:** Logstash
**Created:** [December 28, 2020, 11:16am UTC](https://discuss.elastic.co/t/logstash-grok-hour-and-minute-ruby/259724 "2020-12-28T11:16:48Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Cristiane\_Marcarini](https://discuss.elastic.co/u/Cristiane_Marcarini)
#### Post date: [December 28, 2020, 11:16am UTC](https://discuss.elastic.co/t/logstash-grok-hour-and-minute-ruby/259724/1 "2020-12-28T11:16:48Z")
Hi,
I have a grok and I don't want to change it, but I wanted to have the hour and minutes separate, it could be using Ruby, something like that.
Thanks
else if "performanceLog" in [path]
{
grok
{
match =\> {"message" =\> "(?%{YEAR:year}/%{MONTHNUM:month}/%{MONTHDAY:day}-%{TIME:date}) | %{USERNAME:username} | %{DATA:balcao} | %{DATA:server} | (%{DATA:transaction} | %{BASE10NUM:time}|%{GREEDYDATA:message})" }
overwrite =\> ["message"]
}
}
grok
{
break\_on\_match =\> false
match =\> {"path" =\> "(%{GREEDYDATA}/%{DATA:filename}\_%{GREEDYDATA}.txt)|%{GREEDYDATA}"}
match =\> {"message" =\> "(?[\S]\*Exception:)"}
}
mutate
{
add\_field =\> {"logDate" =\> "%{year}-%{month}-%{day} %{date}"}
convert =\> {
"time" =\> "integer"
"conexoes" =\> "integer"
"ELKValue" =\> "integer"
```
}
}
ruby
{
code => 'event.set("timeGroup", ((event.get("time").to_f / 5).ceil) * 5)'
}
date
{
match => ["logDate", "yyyy-MM-dd HH:mm:ss.SSS"]
target => "@timestamp"
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 25, 2021, 11:16am UTC](https://discuss.elastic.co/t/logstash-grok-hour-and-minute-ruby/259724/2 "2021-01-25T11:16:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.