# How to split timestamp to date AND time

**URL:** <https://community.graylog.org/t/how-to-split-timestamp-to-date-and-time/14632>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules, time-stamp-issuespl\
**Created:** [March 25, 2020, 8:51am UTC](https://community.graylog.org/t/how-to-split-timestamp-to-date-and-time/14632 "2020-03-25T08:51:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![laakkus](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/laakkus/32/3060_2.png) [@laakkus](https://community.graylog.org/u/laakkus)\
**Post date:** [March 25, 2020, 8:51am UTC](https://community.graylog.org/t/how-to-split-timestamp-to-date-and-time/14632/1 "2020-03-25T08:51:33Z")

</div>

Stupid question maybe, but I have scratched my face to this stupid wall enough today…

from this:  
timestamp: 2020-03-25 10:34:00 +02:00 (hower shows it like 2020-03-25T08:34:00.191Z)

to these:  
date: 2020-03-25  
time: 10:34:00 (or 10:34:00.191)

NOW I have this pipeline:

> rule “split\_timestamp”  
> when  
> has\_field(“timestamp”)  
> then  
> let stamp = regex((“(^._)T(._)”),to\_string($message.timestamp));
> 
> ```
> set_field("date", to_string(stamp["0"]));
> set_field("time", to_string(stamp["1"]));
> //set_field("ts_minute", $message.timestamp.minuteOfHour);
> //set_field("ts_second", $message.timestamp.secondOfMinute);
> 
> ```
> 
> end

But the resulting is (not from same logrow, but You see the format:  
date: 2020-03-25 00:00:00 +02:00 (hovers “correctly” 2020-03-25)  
time: 08:34:00.191Z (can leave the Z by altering pipeline regex)

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [March 31, 2020, 10:18am UTC](https://community.graylog.org/t/how-to-split-timestamp-to-date-and-time/14632/2 "2020-03-31T10:18:54Z")

</div>

Graylog internally store timestamps as UTC, and show it as timezone you setup (based on user account profile settings). If you login as admin user, check if you have setup correct timezone in server.conf file:

Change line:  
`root_timezone = Europe/Bratislava`

or similar to your real timezone, and restart graylog service.

If you use another user (as admin), chcek your timezone settings in your use profile.

---

<div class="post-metadata">

**Author:** ![cawfehman](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/cawfehman/32/4132_2.png) [@cawfehman](https://community.graylog.org/u/cawfehman)\
**Post date:** [March 31, 2020, 11:43pm UTC](https://community.graylog.org/t/how-to-split-timestamp-to-date-and-time/14632/3 "2020-03-31T23:43:19Z")

</div>

I did this with extractors and not pipelines, but I’m sure you can modify… the grok patterns in Graylog weren’t enough, so I created 2 new ones based off existing ones and then used them in my extractor.

Grok Pattern TS-YMND (TimeStamp-YearMonthNumDay)  
TS\_YMND (?\>\d\d){1,2}/-/-

Grok Pattern Time\_HMSu (HoursMinutesSecondsMicroseconds)  
Time\_HMSu (?!\<[0-9])(?:2[0123]|[01]?[0-9]):(?:[0-5][0-9])(?::(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?))(?![0-9])

finaly I created an extractor that looks like this:  
%{TS\_YMND:MessageDate}T%{Time\_HMSu:MessageTime}%{ISO8601\_TIMEZONE:ISO-Timezone}

ISO8601\_TIMEZONE is a builtin and is optional… I use both…so you could probably just use

%{TS\_YMND:MessageDate}T%{Time\_HMSu:MessageTime}

hth…

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [April 14, 2020, 11:45pm UTC](https://community.graylog.org/t/how-to-split-timestamp-to-date-and-time/14632/4 "2020-04-14T23:45:56Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.