# Timestamp between certain hours any day?

**URL:** <https://discuss.elastic.co/t/timestamp-between-certain-hours-any-day/236535>\
**Category:** Kibana\
**Created:** [June 10, 2020, 3:32pm UTC](https://discuss.elastic.co/t/timestamp-between-certain-hours-any-day/236535 "2020-06-10T15:32:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![stcdarrell](https://avatars.discourse-cdn.com/v4/letter/s/a183cd/32.png) [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\
**Post date:** [June 10, 2020, 3:32pm UTC](https://discuss.elastic.co/t/timestamp-between-certain-hours-any-day/236535/1 "2020-06-10T15:32:54Z")

</div>

hi, i'm working a DFIR case, i'm fairly new to KIbana.  
i'm got millions of log entries to sift through. i need to see the log entries of a certain kind that were created after normal business hours any day of the week. for instance:  
"Display the ssh logs created from 7pm --\> 6am for the last 6 months"

i cant figure out how to do this, any suggestions?

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [June 10, 2020, 5:07pm UTC](https://discuss.elastic.co/t/timestamp-between-certain-hours-any-day/236535/2 "2020-06-10T17:07:06Z")

</div>

You can create a scripted field "hour of day" and then filter based on it. An example is part of the "Logs" sample data set.

If your data volume is large, this approach can become slow - if you are hit by that, you can move this calculation into the ingest phase by using Logstash or an Elasticsearch ingest pipeline. But IMHO it makes sense to start with a scripted field and see whether it's enough.

---

<div class="post-metadata">

**Author:** ![stcdarrell](https://avatars.discourse-cdn.com/v4/letter/s/a183cd/32.png) [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\
**Post date:** [June 20, 2020, 12:22am UTC](https://discuss.elastic.co/t/timestamp-between-certain-hours-any-day/236535/3 "2020-06-20T00:22:23Z")

</div>

thank you, this worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 18, 2020, 12:22am UTC](https://discuss.elastic.co/t/timestamp-between-certain-hours-any-day/236535/4 "2020-07-18T00:22:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.