Search Kibana for Out of Hours Logs

[MultiplierMultiplier (G T)]

Hi All,

I would like to search for logs with the field 'Target'UserName' that are from 19:00:00 until 07:00:00. This would allow me to monitor for out of hours activity for our users. I understand how to find logs with the field 'TargetUserName', I use exists:TargetUserName. I just need help with showing on logs with a TimeStamp from 7pm until 7am. I have tried the below Regex:

TimeStamp:/(\d{4}-\d{2}-\d{2}\s(19|20|21|22|23|01|02|03|04|05|06|1|2|3|4|5|6):\d+:\d+)/

When I run that Regex query I see no logs.

EDIT:
Here is an example of the TimeStamp field so you can see the format:

Dec 20 14:01:00

Any ideas?

Cheers,

George

[Nathan_Reese]

I would recommend re-indexing your data and adding a new field called minuteOfDay that contains the time of day in minutes (a value between 0 and 1440). Then you can simply query for something like minuteOfDay: [0 TO 420] OR minuteOfDay: [1140 TO 1440]

[MultiplierMultiplier (G T)]

All of my logs are coming from Graylog, how would I go about parsing a single field into another field?

I would need to parse TimeStamp -> HourOfDay.

How would I go about doing this?

Cheers

George