Extract Month From Timestamp

Get the month from a timestamp using the time:month() function

Query

flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1["Expression"] result{{Result Set}} repo --> 1 1 --> result
logscale
time:month(timestamp, as=month)

Introduction

The time:month() function can be used to extract the month (1-12) from a timestamp field. It returns the month as an integer value where January is 1 and December is 12.

In this example, the time:month() function is used to extract the month from a specific timestamp 2025-08-27 08:51:51.312, demonstrating how to get the month value from a datetime.

Step-by-Step

  1. Starting with the source repository events.

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1["Expression"] result{{Result Set}} repo --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    time:month(timestamp, as=month)

    Extracts the month from the @timestamp field and returns the result in a new field named month. If the as parameter is not specified, the result is returned in a field named _month as default.

  3. Event Result set.

Summary and Results

The query is used to extract the month from a timestamp, which is useful for analyzing events at a monthly level.

This query is useful, for example, to analyze monthly patterns, group events by month, or investigate seasonal trends throughout the year.

Sample output from the incoming example data:

@timestampmonth
2025-08-27 08:51:51.3128

The result shows how the time:month() function extracts the month (in this case 8) from the timestamp, indicating August (the eighth month of the year).

For visualizing this data, consider using a Bar Chart widget to show event distribution across months, or a Heat Map widget to display activity patterns throughout the year. The time:month() function is often used with other time functions like time:year() and time:dayOfMonth() for complete date analysis.