# Logstash set hour %{+HH} timezone on strings?

**URL:** https://discuss.elastic.co/t/logstash-set-hour-hh-timezone-on-strings/75236
**Category:** Logstash
**Created:** [February 15, 2017, 5:51pm UTC](https://discuss.elastic.co/t/logstash-set-hour-hh-timezone-on-strings/75236 "2017-02-15T17:51:47Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![mostolog](https://avatars.discourse-cdn.com/v4/letter/m/858c86/32.png) [@mostolog](https://discuss.elastic.co/u/mostolog)
#### Post date: [February 15, 2017, 5:51pm UTC](https://discuss.elastic.co/t/logstash-set-hour-hh-timezone-on-strings/75236/1 "2017-02-15T17:51:47Z")

</div>

Hi

When dealing with Logstash dates, anyone can easily convert a text string date field to a real date ( **with proper TZ and DST** ) using date filter:

```auto
    date {
        timezone => "Europe/Madrid"
        match => ["mytime", "ISO8601"]
        locale => "es"
    }

```

(please, **notice timezone** (and locale) above)

However, I would like to append **current hour** to a string field and seems:

> mutate { replace =\> { "field" =\> "%{field}-%{+HH}" } }

it's adding hours in UTC, so it's always **1 hour less than it should**.

**What's would be the proper way to do it?**

Thanks,  
Regards

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 15, 2017, 6:24pm UTC](https://discuss.elastic.co/t/logstash-set-hour-hh-timezone-on-strings/75236/2 "2017-02-15T18:24:00Z")

</div>

The `%{+format}` notation always uses the `@timestamp` field which by definition is UTC. This is not configurable.

---

<div class="post-metadata">

### Author: ![mostolog](https://avatars.discourse-cdn.com/v4/letter/m/858c86/32.png) [@mostolog](https://discuss.elastic.co/u/mostolog)
#### Post date: [February 16, 2017, 9:09am UTC](https://discuss.elastic.co/t/logstash-set-hour-hh-timezone-on-strings/75236/3 "2017-02-16T09:09:07Z")

</div>

Damn it!  
Any way to extract HH from @timestamp field (already with TZ and DST?) regex? substring? event['@timestamp][x..y]? [Substring in logstash](https://discuss.elastic.co/t/substring-in-logstash/57070)

Regards

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 16, 2017, 9:13am UTC](https://discuss.elastic.co/t/logstash-set-hour-hh-timezone-on-strings/75236/4 "2017-02-16T09:13:33Z")

</div>

You can use a ruby filter to read the timestamp value in `@timestamp`. That object might have a strftime() method that you can use.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 16, 2017, 9:13am UTC](https://discuss.elastic.co/t/logstash-set-hour-hh-timezone-on-strings/75236/5 "2017-03-16T09:13:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
