# Visualizations using time only not date
**URL:** https://discuss.elastic.co/t/visualizations-using-time-only-not-date/77955
**Category:** Kibana
**Created:** [March 9, 2017, 9:29am UTC](https://discuss.elastic.co/t/visualizations-using-time-only-not-date/77955 "2017-03-09T09:29:15Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Pokecallum](https://discuss.elastic.co/u/Pokecallum)
#### Post date: [March 9, 2017, 9:29am UTC](https://discuss.elastic.co/t/visualizations-using-time-only-not-date/77955/1 "2017-03-09T09:29:15Z")
I'm looking to create a graph that only uses the time data from my Date field which after going through a csv filter shows as
February 28th 2017, 14:43:29.000
An being being able to see the time a user logs in over the period of a month.
I'm sure i read that this can be done using a scripted field but unsure where to even start
---
### Author:  [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)
#### Post date: [March 9, 2017, 12:39pm UTC](https://discuss.elastic.co/t/visualizations-using-time-only-not-date/77955/2 "2017-03-09T12:39:20Z")
@Pokecallum you can use the following Script to create a Scripted Field to extract the time from a Date field:
```auto
def dateFormat = new SimpleDateFormat("HH:mm:ss");
return dateFormat.format(doc['utc_time'].value);
```
Just in case you haven't created a scripted field before, to get there you'll click Management -\> Index Patterns -\> Scripted Fields -\> Add Scripted Field as highlighted below:
---
### Author:  [@Pokecallum](https://discuss.elastic.co/u/Pokecallum)
#### Post date: [March 9, 2017, 1:50pm UTC](https://discuss.elastic.co/t/visualizations-using-time-only-not-date/77955/3 "2017-03-09T13:50:49Z")
Hi thanks, although I get a runtime error when trying to use this. I've been trying to add the time field by itself so then Ill be able to use the range aggregation to get what I want. Would you happen to know the reason why my convert for hour =\> integer doesnt work. but size does ?
```
input {
file {
type => "csv"
path => "/home/callum/Desktop/test2/*.csv"
start_position => beginning
sincedb_path => "/dev/null"
}
}
filter {
csv {
separator => ","
columns => ["Date","User","Size","File Type","Device Class","Device Model","File Name","Time"]
}
date {
match => ["Date", "yyyy-MM-dd'T'HH:mm:ssZZ"]
}
mutate {
rename => {"Date" => "Time"}
add_field => {"[hour]" => "%{+HH:mm:ss:z}"}
convert => { "hour" => "integer" }
convert => { "Size" => "integer" }
remove_field => ["message","path","host","type"]
lowercase => ["Date","User","Size","File Type","Device Class","Device Model","File Name"]
}
}
output {
elasticsearch {
hosts => "http://localhost:9200"
index => "a"
}
}
```
---
### Author:  [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)
#### Post date: [March 9, 2017, 1:57pm UTC](https://discuss.elastic.co/t/visualizations-using-time-only-not-date/77955/4 "2017-03-09T13:57:06Z")
@Pokecallum I failed to note that you'll want to replace the field that you're looking to take the Time from in the sample script that I posted, does the following Script work?
```auto
def dateFormat = new SimpleDateFormat("HH:mm:ss");
return dateFormat.format(doc['Date'].value);
```
You can definitely do it on the logstash side as well, what are you seeing when you try to use your provided logstash configuration?
---
### Author:  [@Pokecallum](https://discuss.elastic.co/u/Pokecallum)
#### Post date: [March 9, 2017, 2:14pm UTC](https://discuss.elastic.co/t/visualizations-using-time-only-not-date/77955/5 "2017-03-09T14:14:03Z")
```
"User" => "callum",
"Size" => 61751,
"File Type" => "xlsx",
"Time" => "2017-02-25T13:19:03Z",
"@timestamp" => 2017-02-25T13:19:03.000Z,
"Device Class" => "removable",
"Device Model" => "sandisk cruzer blade usb device, disk drive, (standard disk drives)",
"hour" => "13",
"@version" => "1",
"File Name" => "j:my spreadsheet.xlsx"
```
Unfortuantly Im getting the same error with that script, although I think its probably me using it in the wrong way.
I'd much rather do it through logstash, as I understand that more although Im not getting any errors with my config.
---
### Author:  [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)
#### Post date: [March 9, 2017, 2:48pm UTC](https://discuss.elastic.co/t/visualizations-using-time-only-not-date/77955/6 "2017-03-09T14:48:52Z")
@Pokecallum completely understand your preference to use Logstash to do so. I'd recommend posting this question in the Logstash category though, if that's the route you'd like to go.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 6, 2017, 2:49pm UTC](https://discuss.elastic.co/t/visualizations-using-time-only-not-date/77955/7 "2017-04-06T14:49:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.