# Retrieve Hour and Day from Timestamp

**URL:** https://discuss.elastic.co/t/retrieve-hour-and-day-from-timestamp/216093
**Category:** Logstash
**Created:** [January 22, 2020, 4:07pm UTC](https://discuss.elastic.co/t/retrieve-hour-and-day-from-timestamp/216093 "2020-01-22T16:07:40Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Jim\_Thunder](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jim_thunder/32/45439_2.png) [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)
#### Post date: [January 22, 2020, 4:07pm UTC](https://discuss.elastic.co/t/retrieve-hour-and-day-from-timestamp/216093/1 "2020-01-22T16:07:40Z")

</div>

Hello!

My code here is getting the hour and day from a newly (and more accurate) timestamp. The timestamp is updated with a `-0600` for the timezone. When I retrieve the `hour` from this timestamp, it doesn't include the fact that the timezone changed. So the `hour` is 6 hours ahead. How can I fix that?

(I know I can't just subtract 6 b/c then I run into all kinds of issues with 3pm - 6 = "a negative hour" ..etc)

```
  if [sourceType] == "zOS-SMF_030" {
    csv{
        columns => ["Correlator", "SMF30LEN", "SMF30SEG", "SMF30FLG", "SMF30RTY", "SMF30PSN", "SMF30CL8", "SMF30ISS", "SMF30IET", "SMF30SSN", "SMF30EXN", "SMF30ASI", "SMF30COR"]
        separator => ","
    }
    mutate { add_field => {
        "@SMF_TIMESTAMP" => "%{SMF30DTE} %{SMF30TME}"
    }}
    date {
        match => ["@SMF_TIMESTAMP", "YYYY-MM-dd HH:mm:ss:SSS"]
        target => "@SMF_TIMESTAMP"
        timezone => "-0600"
    }
    ruby {
      code => "event.set('[day_of_week]',event.get('@SMF_TIMESTAMP').time.strftime('%a'))
      event.set('[hour]',event.get('@SMF_TIMESTAMP').time.strftime('%H'))
      event.set('[day]',event.get('@SMF_TIMESTAMP').time.strftime('%d'))"
    }
    mutate {
      convert => {
        "day" => "integer"
        "hour" => "integer"
      }
    }
  }

```

Here's an image to help explain:

![image](https://us1.discourse-cdn.com/elastic/original/3X/9/3/93d44498bf68a693b9d23851db2371e0f38c1b22.png)

As you can see the timestamp shows 10am but the `hour` field shows 16 (4pm)

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 22, 2020, 5:26pm UTC](https://discuss.elastic.co/t/retrieve-hour-and-day-from-timestamp/216093/2 "2020-01-22T17:26:38Z")

</div>

If that image is from kibana then note that kibana, by default, will have adjusted @SMF\_TIMESTAMP to the timezone of the browser. It will not be doing that with [hour].

If you want to extract the hour in the local timezone of the log then use another date filter with timezone =\> UTC and run your ruby code against the output of that.

---

<div class="post-metadata">

### Author: ![Jim\_Thunder](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jim_thunder/32/45439_2.png) [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)
#### Post date: [January 22, 2020, 6:28pm UTC](https://discuss.elastic.co/t/retrieve-hour-and-day-from-timestamp/216093/3 "2020-01-22T18:28:28Z")

</div>

Ok, I'll give that a shot and post here whether or not it works

---

<div class="post-metadata">

### Author: ![Jim\_Thunder](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jim_thunder/32/45439_2.png) [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)
#### Post date: [January 27, 2020, 4:10pm UTC](https://discuss.elastic.co/t/retrieve-hour-and-day-from-timestamp/216093/4 "2020-01-27T16:10:05Z")

</div>

This worked like a charm. Thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 24, 2020, 4:10pm UTC](https://discuss.elastic.co/t/retrieve-hour-and-day-from-timestamp/216093/5 "2020-02-24T16:10:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
