Extract specific time field from timestamp in logstash

Question

I have an automatically generated @timestamp with the default format. What i would like is to extract the hour/month/weekday of the timestamp putting it in another field.

For example, now my timestamp looks like that:

@timestamp: "2015-08-26T09:04:42.284Z"

Is there any way to get the following fields?

• hour: 09 (or 9)? In Number format.
• month: 08(or 8, or Aug, August...) Number or string format.
• weekday: Mon, Tue, Wed, ...

I want it to make a kibana4 Histogram based on the hour/day of connections, with an average metric. If there's a different way to achieve that, please tell me!

I've searched all the web for that, but I couldn't find any solution. I would appreciate any help on this.

Answer 1

Finally figured it out.

You can use the notation %{} to do that. Just put:

add_field => {"[hour]" => "%{+HH}"}
add_field => {"[weekday]" => "%{+EEE}"}

Here's a reference of symbols to use.

And that's it!