# See all logs outside business hours

**URL:** <https://community.graylog.org/t/see-all-logs-outside-business-hours/19436>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [April 12, 2021, 9:37am UTC](https://community.graylog.org/t/see-all-logs-outside-business-hours/19436 "2021-04-12T09:37:29Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![farzanba](https://avatars.discourse-cdn.com/v4/letter/f/a5b964/32.png) [@farzanba](https://community.graylog.org/u/farzanba)\
**Post date:** [April 12, 2021, 9:37am UTC](https://community.graylog.org/t/see-all-logs-outside-business-hours/19436/1 "2021-04-12T09:37:30Z")

</div>

Hi everybody,

how can i see all logs outside business hours?

Thanks. 🖐 🖐

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [April 12, 2021, 10:44am UTC](https://community.graylog.org/t/see-all-logs-outside-business-hours/19436/2 "2021-04-12T10:44:42Z")

</div>

1. If you want to filter only one day, you can use `Time frame selector` and choose `Absolute` and setup specific time frame.  
[Time frame selector — Graylog 4.0.0 documentation](https://docs.graylog.org/en/4.0/pages/searching/time_frame_selector.html)
2. If you want to filter all messages try to use this pipeline rule as example, to setup new field out\_of\_hours, and update to your real timezone and required business hours. Then you can use this field for search for messages outside business hours. If will only work for new messages after you deploy pipeline rule.

```auto
rule "out_of_hours"
when
  to_long(now("Europe/London").hourOfDay) >= 0 AND
  to_long(now("Europe/London").hourOfDay) < 7
then
  set_field("out_of_hours", true);
  //debug("out_of_hours");
end

```

---

<div class="post-metadata">

**Author:** ![farzanba](https://avatars.discourse-cdn.com/v4/letter/f/a5b964/32.png) [@farzanba](https://community.graylog.org/u/farzanba)\
**Post date:** [April 19, 2021, 8:57am UTC](https://community.graylog.org/t/see-all-logs-outside-business-hours/19436/3 "2021-04-19T08:57:49Z")

</div>

## I have created a rule in the same way (without change). But it does not work. Can you please tell me where I went wrong

rule “off work hours”  
when  
( to\_long(to\_date($message.timestamp, “Europe/Berlin”).hourOfDay) \>= 0 AND to\_long(to\_date($message.timestamp, “Europe/Berlin”).hourOfDay) \<= 6 ) OR  
( to\_long(to\_date($message.timestamp, “Europe/Berlin”).hourOfDay) \>= 18 AND to\_long(to\_date($message.timestamp, “Europe/Berlin”).hourOfDay) \<= 0 )  
then  
set\_field(“out\_of\_hours”, true);  
end

rule “off work weekend”  
when  
// from Monday (1) to Sunday (7)  
to\_long(to\_date($message.timestamp, “Europe/Berlin”).dayOfWeek) == 7 OR  
to\_long(to\_date($message.timestamp, “Europe/Berlin”).dayOfWeek) == 6  
then  
set\_field(“out\_of\_hours”, true);  
end

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [April 19, 2021, 10:28am UTC](https://community.graylog.org/t/see-all-logs-outside-business-hours/19436/4 "2021-04-19T10:28:54Z")

</div>

No you don’t use it same way. You’ve used `to_date` instead of `now` pipeline function. There is a bug in graylog’s function `to_date` which doesn’t support timezone parameter, or ignore it, and always use UTC.

> <https://github.com/Graylog2/graylog2-server/issues/6486>
>
> Expected Behavior
> using the to\_date function in a processing pipeline to transform a date into the local timezone to be able to...

Also your condition will not match, replace it to `23` instead of `0`  
`to_long(to_date($message.timestamp, “Europe/Berlin”).hourOfDay) <= 0`

Please post, what’s wrong with your pipeline rule and your conditions.

---

<div class="post-metadata">

**Author:** ![farzanba](https://avatars.discourse-cdn.com/v4/letter/f/a5b964/32.png) [@farzanba](https://community.graylog.org/u/farzanba)\
**Post date:** [April 19, 2021, 1:22pm UTC](https://community.graylog.org/t/see-all-logs-outside-business-hours/19436/5 "2021-04-19T13:22:06Z")

</div>

I have prepared everything like this. You can see the screenshots as an attachment

 ![rule](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/f9a64a3e17b46a4a69e1d6092f1a9706eb6b9767.png) ![time](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/8/80a723a283493d1abb5b76d5ba14da17e586f3ce.png)

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [April 19, 2021, 1:58pm UTC](https://community.graylog.org/t/see-all-logs-outside-business-hours/19436/6 "2021-04-19T13:58:04Z")

</div>

You can’t paste 2 rules into pipeline body of rule, please separate it into two pipeline rules. One with rule “off work hours” and one for “off work weekend”.

---

<div class="post-metadata">

**Author:** ![farzanba](https://avatars.discourse-cdn.com/v4/letter/f/a5b964/32.png) [@farzanba](https://community.graylog.org/u/farzanba)\
**Post date:** [April 20, 2021, 5:14am UTC](https://community.graylog.org/t/see-all-logs-outside-business-hours/19436/7 "2021-04-20T05:14:26Z")

</div>

otherwise everything is correct?

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [April 20, 2021, 7:00am UTC](https://community.graylog.org/t/see-all-logs-outside-business-hours/19436/8 "2021-04-20T07:00:29Z")

</div>

As I post, you used function `to_date` with timezone parameter which is ignored. Either use UTC times in condition \>=, \<=, == or use function `now` as i suggested with timezone.

Best way to debug functions is to use simple condition `when true` or similar, and use debug:

```auto
rule "debug_hourOfDay"
when
  true
then
  debug(concat("hourOfDay: ", to_string(now("Europe/Berlin").hourOfDay));
  debug(concat("dayOfWeek: ", to_string(now("Europe/Berlin").dayOfWeek));
end

```

Then check graylog logs file and search for line hourOfDay and dayOfWeek:  
` sudo tail -f /var/log/graylog-server/server.log`

---

<div class="post-metadata">

**Author:** ![farzanba](https://avatars.discourse-cdn.com/v4/letter/f/a5b964/32.png) [@farzanba](https://community.graylog.org/u/farzanba)\
**Post date:** [April 28, 2021, 1:53pm UTC](https://community.graylog.org/t/see-all-logs-outside-business-hours/19436/9 "2021-04-28T13:53:47Z")

</div>

Thank you, this is now working properly.  
🖐 😌

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [May 12, 2021, 1:54pm UTC](https://community.graylog.org/t/see-all-logs-outside-business-hours/19436/10 "2021-05-12T13:54:08Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.