Search Kibana for Out of Hours Logs

Hi All,

I would like to search for logs with the field 'Target'UserName' that are from 19:00:00 until 07:00:00. This would allow me to monitor for out of hours activity for our users. I understand how to find logs with the field 'TargetUserName', I use exists:TargetUserName. I just need help with showing on logs with a TimeStamp from 7pm until 7am. I have tried the below Regex:


When I run that Regex query I see no logs.

Here is an example of the TimeStamp field so you can see the format:

Dec 20 14:01:00

Any ideas?



I would recommend re-indexing your data and adding a new field called minuteOfDay that contains the time of day in minutes (a value between 0 and 1440). Then you can simply query for something like minuteOfDay: [0 TO 420] OR minuteOfDay: [1140 TO 1440]

All of my logs are coming from Graylog, how would I go about parsing a single field into another field?

I would need to parse TimeStamp -> HourOfDay.

How would I go about doing this?



This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.